Analysis
-
max time kernel
151s -
max time network
68s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-12-2022 04:18
Static task
static1
Behavioral task
behavioral1
Sample
d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe
Resource
win7-20220812-en
General
-
Target
d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe
-
Size
407KB
-
MD5
4af688c058e19b716438e7eb80441aea
-
SHA1
97ff16b53ce7e12c2e19dc9cf46b40a1d3dec0c5
-
SHA256
d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917
-
SHA512
da18cf08481f229bdddd75da53c374f1c5146c73670167b2d5af65ae2a4eb02e6ad4b9269457eb79211a3610b18d233906c6ad09ee7cd6592e0be1621ce4f531
-
SSDEEP
12288:B1dlZo5yIBNk2xKAk2n9jMyRdW3yO1dsL+We:B1dlZo5jTLxI2nhMmdWnsRe
Malware Config
Extracted
cybergate
v1.07.5
victima
please23.zapto.org:81
A4AN4P73Y37FMI
-
enable_keylogger
true
-
enable_message_box
false
-
ftp_directory
./logs/
-
ftp_interval
30
-
injected_process
explorer.exe
-
install_dir
install
-
install_file
server.exe
-
install_flag
true
-
keylogger_enable_ftp
false
-
message_box_caption
Remote Administration anywhere in the world.
-
message_box_title
CyberGate
-
password
TEamo239?
-
regkey_hkcu
HKCU
-
regkey_hklm
HKLM
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
Processes:
NBFile.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe" NBFile.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run NBFile.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Windows\\install\\server.exe" NBFile.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run NBFile.exe -
Executes dropped EXE 6 IoCs
Processes:
NBFile.exeNBFile.exeserver.exeserver.exeserver.exeserver.exepid process 1556 NBFile.exe 1388 NBFile.exe 1072 server.exe 1100 server.exe 1784 server.exe 1840 server.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
NBFile.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{T422O587-FR14-3T0Y-4800-7470IS27DBL6} NBFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{T422O587-FR14-3T0Y-4800-7470IS27DBL6}\StubPath = "C:\\Windows\\install\\server.exe Restart" NBFile.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Active Setup\Installed Components\{T422O587-FR14-3T0Y-4800-7470IS27DBL6} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{T422O587-FR14-3T0Y-4800-7470IS27DBL6}\StubPath = "C:\\Windows\\install\\server.exe" explorer.exe -
Processes:
resource yara_rule behavioral1/memory/1388-63-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1388-69-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1388-70-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1416-71-0x0000000002420000-0x0000000002427000-memory.dmp upx behavioral1/memory/1388-72-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1388-74-0x0000000010410000-0x0000000010475000-memory.dmp upx behavioral1/memory/1388-85-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/304-90-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/304-94-0x0000000010480000-0x00000000104E5000-memory.dmp upx behavioral1/memory/1388-101-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral1/memory/1440-106-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral1/memory/1440-108-0x00000000104F0000-0x0000000010555000-memory.dmp upx behavioral1/memory/1388-115-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1784-127-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1784-130-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1840-138-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1784-139-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1840-141-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1784-140-0x0000000000400000-0x0000000000458000-memory.dmp upx behavioral1/memory/1440-143-0x00000000104F0000-0x0000000010555000-memory.dmp upx -
Loads dropped DLL 6 IoCs
Processes:
d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exeNBFile.exeNBFile.exeexplorer.exepid process 1416 d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe 1416 d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe 1556 NBFile.exe 1388 NBFile.exe 1388 NBFile.exe 1440 explorer.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
NBFile.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run NBFile.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Windows\\install\\server.exe" NBFile.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run NBFile.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Windows\\install\\server.exe" NBFile.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
explorer.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini explorer.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
NBFile.exeserver.exeserver.exedescription pid process target process PID 1556 set thread context of 1388 1556 NBFile.exe NBFile.exe PID 1072 set thread context of 1784 1072 server.exe server.exe PID 1100 set thread context of 1840 1100 server.exe server.exe -
Drops file in Windows directory 5 IoCs
Processes:
NBFile.exeexplorer.exeWINWORD.EXEdescription ioc process File opened for modification C:\Windows\install\server.exe NBFile.exe File opened for modification C:\Windows\install\server.exe explorer.exe File opened for modification C:\Windows\install\ explorer.exe File opened for modification C:\Windows\Debug\WIA\wiatrace.log WINWORD.EXE File created C:\Windows\install\server.exe NBFile.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" WINWORD.EXE Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Set value (int) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE -
Modifies registry class 64 IoCs
Processes:
WINWORD.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohevi.dll" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command WINWORD.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe WINWORD.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit WINWORD.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print WINWORD.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon WINWORD.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
WINWORD.EXEpid process 1708 WINWORD.EXE -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
NBFile.exepid process 1388 NBFile.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 1440 explorer.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
explorer.exeexplorer.exedescription pid process Token: SeBackupPrivilege 304 explorer.exe Token: SeRestorePrivilege 304 explorer.exe Token: SeBackupPrivilege 1440 explorer.exe Token: SeRestorePrivilege 1440 explorer.exe Token: SeDebugPrivilege 1440 explorer.exe Token: SeDebugPrivilege 1440 explorer.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
NBFile.exeexplorer.exepid process 1388 NBFile.exe 1440 explorer.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
explorer.exepid process 1440 explorer.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
NBFile.exeWINWORD.EXEserver.exeserver.exepid process 1556 NBFile.exe 1708 WINWORD.EXE 1708 WINWORD.EXE 1072 server.exe 1100 server.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exeNBFile.exeNBFile.exedescription pid process target process PID 1416 wrote to memory of 1556 1416 d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe NBFile.exe PID 1416 wrote to memory of 1556 1416 d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe NBFile.exe PID 1416 wrote to memory of 1556 1416 d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe NBFile.exe PID 1416 wrote to memory of 1556 1416 d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe NBFile.exe PID 1556 wrote to memory of 1388 1556 NBFile.exe NBFile.exe PID 1556 wrote to memory of 1388 1556 NBFile.exe NBFile.exe PID 1556 wrote to memory of 1388 1556 NBFile.exe NBFile.exe PID 1556 wrote to memory of 1388 1556 NBFile.exe NBFile.exe PID 1556 wrote to memory of 1388 1556 NBFile.exe NBFile.exe PID 1556 wrote to memory of 1388 1556 NBFile.exe NBFile.exe PID 1556 wrote to memory of 1388 1556 NBFile.exe NBFile.exe PID 1556 wrote to memory of 1388 1556 NBFile.exe NBFile.exe PID 1556 wrote to memory of 1388 1556 NBFile.exe NBFile.exe PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE PID 1388 wrote to memory of 1248 1388 NBFile.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe"C:\Users\Admin\AppData\Local\Temp\d1431ffce4e448e941fb950a60bba15fd8fdcdad50bd75083e8d0d38c465b917.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NBFile.exe"C:\Users\Admin\AppData\Local\Temp\NBFile.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\NBFile.exe"C:\Users\Admin\AppData\Local\Temp\NBFile.exe"4⤵
- Adds policy Run key to start application
- Executes dropped EXE
- Modifies Installed Components in the registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\explorer.exeexplorer.exe5⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\install\server.exe"C:\Windows\install\server.exe"6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\install\server.exe"C:\Windows\install\server.exe"7⤵
- Executes dropped EXE
-
C:\Windows\install\server.exe"C:\Windows\install\server.exe"5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
-
C:\Windows\install\server.exe"C:\Windows\install\server.exe"6⤵
- Executes dropped EXE
-
C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\Graficas1.docx"3⤵
- Drops file in Windows directory
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122884⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Admin2.txtFilesize
224KB
MD555be163c93ece96131a1b2d1a79105b2
SHA1fc7f018d610b65c09f614892aa80eeaa03727bee
SHA256eccd00de8c992238bca1508cd8aff33c58b561d08e98afeb1509343fe966bdfb
SHA512021a19b7c614f8b3011a62f82e0ce916235ba9c175de55127765f90c2914c5577e863840531d5693a64c26ce22a24a6e3ecd7f2bcbaaa64c43cbe2cde8aab83c
-
C:\Users\Admin\AppData\Local\Temp\NBFile.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
C:\Users\Admin\AppData\Local\Temp\NBFile.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
C:\Users\Admin\AppData\Local\Temp\NBFile.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
C:\Windows\install\server.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
C:\Windows\install\server.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
C:\Windows\install\server.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
C:\Windows\install\server.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
C:\Windows\install\server.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\NBFile.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
\Users\Admin\AppData\Local\Temp\NBFile.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
\Users\Admin\AppData\Local\Temp\NBFile.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
\Windows\install\server.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
\Windows\install\server.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
\Windows\install\server.exeFilesize
291KB
MD5379e9aebff117fad70173b7494bc2edc
SHA10fb5b96b26658d36ef73a51e3b63d3d542982947
SHA256ab93ddd1558fa7470a98bdaf3246ee72ddfadeec2f6771edc6a50cd1c8b68fb3
SHA5120f4e15bd2ef1ea04b187646fbd1c828d13774421c21e9e3eb785a63cb9e8352eb8fc67f228bb563afb6c2c66ca471e33d4408b7f12b44ae0b1bf964cd81a99d4
-
memory/304-94-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/304-80-0x0000000000000000-mapping.dmp
-
memory/304-90-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/304-83-0x0000000073C41000-0x0000000073C43000-memory.dmpFilesize
8KB
-
memory/1072-129-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1072-111-0x0000000000000000-mapping.dmp
-
memory/1100-133-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1100-117-0x0000000000000000-mapping.dmp
-
memory/1248-77-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/1388-101-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/1388-72-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1388-70-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1388-85-0x0000000010480000-0x00000000104E5000-memory.dmpFilesize
404KB
-
memory/1388-74-0x0000000010410000-0x0000000010475000-memory.dmpFilesize
404KB
-
memory/1388-115-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1388-69-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1388-64-0x0000000000456620-mapping.dmp
-
memory/1388-63-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1416-71-0x0000000002420000-0x0000000002427000-memory.dmpFilesize
28KB
-
memory/1416-54-0x0000000075E81000-0x0000000075E83000-memory.dmpFilesize
8KB
-
memory/1440-106-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/1440-143-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/1440-144-0x0000000003BC0000-0x0000000003BC7000-memory.dmpFilesize
28KB
-
memory/1440-108-0x00000000104F0000-0x0000000010555000-memory.dmpFilesize
404KB
-
memory/1440-96-0x0000000000000000-mapping.dmp
-
memory/1440-137-0x0000000003BC0000-0x0000000003BC7000-memory.dmpFilesize
28KB
-
memory/1512-146-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmpFilesize
8KB
-
memory/1512-145-0x0000000000000000-mapping.dmp
-
memory/1556-66-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/1556-57-0x0000000000000000-mapping.dmp
-
memory/1708-82-0x0000000000000000-mapping.dmp
-
memory/1708-142-0x0000000070FFD000-0x0000000071008000-memory.dmpFilesize
44KB
-
memory/1708-84-0x0000000072591000-0x0000000072594000-memory.dmpFilesize
12KB
-
memory/1708-149-0x0000000070FFD000-0x0000000071008000-memory.dmpFilesize
44KB
-
memory/1708-148-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1708-91-0x0000000070011000-0x0000000070013000-memory.dmpFilesize
8KB
-
memory/1708-107-0x0000000070FFD000-0x0000000071008000-memory.dmpFilesize
44KB
-
memory/1708-99-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/1784-140-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1784-127-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1784-130-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1784-139-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1784-120-0x0000000000456620-mapping.dmp
-
memory/1840-141-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB
-
memory/1840-128-0x0000000000456620-mapping.dmp
-
memory/1840-138-0x0000000000400000-0x0000000000458000-memory.dmpFilesize
352KB