Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
28-10-2022 08:37
Static task
static1
Behavioral task
behavioral1
Sample
ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exe
Resource
win10v2004-20220812-en
General
-
Target
ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exe
-
Size
1.3MB
-
MD5
05537902058bc265bf790af120df1723
-
SHA1
cd69a5a835ec1043537a214f9f5b691502b9862d
-
SHA256
ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089
-
SHA512
98de7cd81e76f1ba04132e10bb5ce23b486ce0730c8e7178bd29cc2e91d18e76efe28e24d3b31e3816e11404fbb3905acbd85bf7d54ccc3b8961ffc6064f7597
-
SSDEEP
24576:MAOcZXgZd9/xGcLEQprgWA78zmi8wC8c4TjgbKc6QSGoNuTgl9RTxtv5V:a33oMrgWi8ai8R8cw46OZT8XT/v5V
Malware Config
Extracted
netwire
37.0.14.206:3384
-
activex_autorun
false
-
copy_executable
true
-
delete_original
false
-
host_id
HostId-%Rand%
-
install_path
%AppData%\Install\Host.exe
-
keylogger_dir
%AppData%\Logs\
-
lock_executable
true
-
offline_keylogger
true
-
password
Password234
-
registry_autorun
false
-
use_mutex
false
Signatures
-
NetWire RAT payload 64 IoCs
Processes:
resource yara_rule behavioral2/memory/100-138-0x0000000001330000-0x000000000185A000-memory.dmp netwire behavioral2/memory/100-139-0x000000000133242D-mapping.dmp netwire behavioral2/memory/100-142-0x0000000001330000-0x000000000185A000-memory.dmp netwire behavioral2/memory/100-146-0x0000000001330000-0x000000000185A000-memory.dmp netwire behavioral2/memory/1160-154-0x0000000001300000-0x0000000001946000-memory.dmp netwire behavioral2/memory/1160-155-0x000000000130242D-mapping.dmp netwire behavioral2/memory/1160-158-0x0000000001300000-0x0000000001946000-memory.dmp netwire behavioral2/memory/1160-164-0x0000000001300000-0x0000000001946000-memory.dmp netwire behavioral2/memory/1356-168-0x00000000005C0000-0x0000000000A77000-memory.dmp netwire behavioral2/memory/1356-169-0x00000000005C242D-mapping.dmp netwire behavioral2/memory/1356-172-0x00000000005C0000-0x0000000000A77000-memory.dmp netwire behavioral2/memory/1356-176-0x00000000005C0000-0x0000000000A77000-memory.dmp netwire behavioral2/memory/3456-182-0x0000000000D0242D-mapping.dmp netwire behavioral2/memory/3456-181-0x0000000000D00000-0x00000000011F1000-memory.dmp netwire behavioral2/memory/3456-185-0x0000000000D00000-0x00000000011F1000-memory.dmp netwire behavioral2/memory/3456-188-0x0000000000D00000-0x00000000011F1000-memory.dmp netwire behavioral2/memory/4236-194-0x0000000001320000-0x0000000001A72000-memory.dmp netwire behavioral2/memory/4236-195-0x000000000132242D-mapping.dmp netwire behavioral2/memory/4236-198-0x0000000001320000-0x0000000001A72000-memory.dmp netwire behavioral2/memory/4236-200-0x0000000001320000-0x0000000001A72000-memory.dmp netwire behavioral2/memory/1184-207-0x0000000000F00000-0x000000000150E000-memory.dmp netwire behavioral2/memory/1184-208-0x0000000000F0242D-mapping.dmp netwire behavioral2/memory/1184-211-0x0000000000F00000-0x000000000150E000-memory.dmp netwire behavioral2/memory/1184-213-0x0000000000F00000-0x000000000150E000-memory.dmp netwire behavioral2/memory/1288-220-0x0000000000D00000-0x0000000001414000-memory.dmp netwire behavioral2/memory/1288-221-0x0000000000D0242D-mapping.dmp netwire behavioral2/memory/1288-224-0x0000000000D00000-0x0000000001414000-memory.dmp netwire behavioral2/memory/1288-226-0x0000000000D00000-0x0000000001414000-memory.dmp netwire behavioral2/memory/2564-233-0x0000000000400000-0x0000000000AC1000-memory.dmp netwire behavioral2/memory/2564-234-0x000000000040242D-mapping.dmp netwire behavioral2/memory/2564-237-0x0000000000400000-0x0000000000AC1000-memory.dmp netwire behavioral2/memory/2564-239-0x0000000000400000-0x0000000000AC1000-memory.dmp netwire behavioral2/memory/2232-246-0x0000000000900000-0x0000000000F55000-memory.dmp netwire behavioral2/memory/2232-247-0x000000000090242D-mapping.dmp netwire behavioral2/memory/2232-250-0x0000000000900000-0x0000000000F55000-memory.dmp netwire behavioral2/memory/2232-252-0x0000000000900000-0x0000000000F55000-memory.dmp netwire behavioral2/memory/4380-260-0x0000000000D0242D-mapping.dmp netwire behavioral2/memory/4380-259-0x0000000000D00000-0x00000000011B1000-memory.dmp netwire behavioral2/memory/4380-263-0x0000000000D00000-0x00000000011B1000-memory.dmp netwire behavioral2/memory/4380-265-0x0000000000D00000-0x00000000011B1000-memory.dmp netwire behavioral2/memory/4724-273-0x000000000090242D-mapping.dmp netwire behavioral2/memory/4724-272-0x0000000000900000-0x0000000000E18000-memory.dmp netwire behavioral2/memory/4724-276-0x0000000000900000-0x0000000000E18000-memory.dmp netwire behavioral2/memory/4724-280-0x0000000000900000-0x0000000000E18000-memory.dmp netwire behavioral2/memory/4228-286-0x000000000115242D-mapping.dmp netwire behavioral2/memory/4228-285-0x0000000001150000-0x00000000017B8000-memory.dmp netwire behavioral2/memory/4228-289-0x0000000001150000-0x00000000017B8000-memory.dmp netwire behavioral2/memory/4228-291-0x0000000001150000-0x00000000017B8000-memory.dmp netwire behavioral2/memory/400-296-0x000000000043242D-mapping.dmp netwire behavioral2/memory/400-295-0x0000000000430000-0x0000000000B28000-memory.dmp netwire behavioral2/memory/400-298-0x0000000000430000-0x0000000000B28000-memory.dmp netwire behavioral2/memory/400-299-0x0000000000430000-0x0000000000B28000-memory.dmp netwire behavioral2/memory/4924-303-0x0000000000BB0000-0x000000000112B000-memory.dmp netwire behavioral2/memory/4924-304-0x0000000000BB242D-mapping.dmp netwire behavioral2/memory/4924-306-0x0000000000BB0000-0x000000000112B000-memory.dmp netwire behavioral2/memory/4924-307-0x0000000000BB0000-0x000000000112B000-memory.dmp netwire behavioral2/memory/760-312-0x00000000013A242D-mapping.dmp netwire behavioral2/memory/760-311-0x00000000013A0000-0x0000000001AAB000-memory.dmp netwire behavioral2/memory/760-314-0x00000000013A0000-0x0000000001AAB000-memory.dmp netwire behavioral2/memory/760-316-0x00000000013A0000-0x0000000001AAB000-memory.dmp netwire behavioral2/memory/3576-320-0x000000000090242D-mapping.dmp netwire behavioral2/memory/3576-319-0x0000000000900000-0x0000000000E46000-memory.dmp netwire behavioral2/memory/3576-322-0x0000000000900000-0x0000000000E46000-memory.dmp netwire behavioral2/memory/3576-324-0x0000000000900000-0x0000000000E46000-memory.dmp netwire -
Executes dropped EXE 64 IoCs
Processes:
voggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifRegSvcs.exeHost.exevoggchu.pifpid process 2252 voggchu.pif 100 RegSvcs.exe 4264 Host.exe 2044 voggchu.pif 1160 RegSvcs.exe 1220 Host.exe 1468 voggchu.pif 1356 RegSvcs.exe 4940 Host.exe 4336 voggchu.pif 3456 RegSvcs.exe 3524 Host.exe 744 voggchu.pif 4236 RegSvcs.exe 680 Host.exe 2072 voggchu.pif 1184 RegSvcs.exe 3028 Host.exe 3556 voggchu.pif 1288 RegSvcs.exe 4308 Host.exe 4688 voggchu.pif 2564 RegSvcs.exe 4252 Host.exe 1588 voggchu.pif 2232 RegSvcs.exe 1984 Host.exe 1356 voggchu.pif 4380 RegSvcs.exe 4480 Host.exe 2608 voggchu.pif 4724 RegSvcs.exe 2068 Host.exe 1824 voggchu.pif 4228 RegSvcs.exe 2124 Host.exe 4976 voggchu.pif 400 RegSvcs.exe 2544 Host.exe 1716 voggchu.pif 4924 RegSvcs.exe 1152 Host.exe 1960 voggchu.pif 760 RegSvcs.exe 1508 Host.exe 5016 voggchu.pif 3576 RegSvcs.exe 1568 Host.exe 1980 voggchu.pif 1468 RegSvcs.exe 2232 Host.exe 4380 voggchu.pif 4020 RegSvcs.exe 3376 Host.exe 2508 voggchu.pif 4424 RegSvcs.exe 3284 Host.exe 1624 voggchu.pif 4032 RegSvcs.exe 2448 Host.exe 956 voggchu.pif 4420 RegSvcs.exe 5064 Host.exe 3832 voggchu.pif -
Checks computer location settings 2 TTPs 64 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
RegSvcs.exevoggchu.pifvoggchu.pifWScript.exevoggchu.pifvoggchu.pifWScript.exevoggchu.pifWScript.exevoggchu.pifWScript.exeRegSvcs.exeWScript.exevoggchu.pifWScript.exeRegSvcs.exevoggchu.pifvoggchu.pifWScript.exeWScript.exeRegSvcs.exevoggchu.pifRegSvcs.exeRegSvcs.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exeWScript.exeWScript.exeRegSvcs.exeRegSvcs.exeRegSvcs.exeRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exeWScript.exevoggchu.pifWScript.exeWScript.exeee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exeRegSvcs.exeRegSvcs.exeRegSvcs.exeWScript.exeRegSvcs.exevoggchu.pifvoggchu.pifRegSvcs.exevoggchu.pifvoggchu.pifvoggchu.pifWScript.exeRegSvcs.exeWScript.exeWScript.exeRegSvcs.exeRegSvcs.exeWScript.exeRegSvcs.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation voggchu.pif Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation WScript.exe Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation RegSvcs.exe -
Adds Run key to start application 2 TTPs 52 IoCs
Processes:
voggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifdescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WindowsUpdate = "C:\\Users\\Admin\\AppData\\Roaming\\10_45\\voggchu.pif C:\\Users\\Admin\\AppData\\Roaming\\10_45\\bdtfjhrh.onv" voggchu.pif Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run voggchu.pif -
Suspicious use of SetThreadContext 26 IoCs
Processes:
voggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifdescription pid process target process PID 2252 set thread context of 100 2252 voggchu.pif RegSvcs.exe PID 2044 set thread context of 1160 2044 voggchu.pif RegSvcs.exe PID 1468 set thread context of 1356 1468 voggchu.pif RegSvcs.exe PID 4336 set thread context of 3456 4336 voggchu.pif RegSvcs.exe PID 744 set thread context of 4236 744 voggchu.pif RegSvcs.exe PID 2072 set thread context of 1184 2072 voggchu.pif RegSvcs.exe PID 3556 set thread context of 1288 3556 voggchu.pif RegSvcs.exe PID 4688 set thread context of 2564 4688 voggchu.pif RegSvcs.exe PID 1588 set thread context of 2232 1588 voggchu.pif RegSvcs.exe PID 1356 set thread context of 4380 1356 voggchu.pif RegSvcs.exe PID 2608 set thread context of 4724 2608 voggchu.pif RegSvcs.exe PID 1824 set thread context of 4228 1824 voggchu.pif RegSvcs.exe PID 4976 set thread context of 400 4976 voggchu.pif RegSvcs.exe PID 1716 set thread context of 4924 1716 voggchu.pif RegSvcs.exe PID 1960 set thread context of 760 1960 voggchu.pif RegSvcs.exe PID 5016 set thread context of 3576 5016 voggchu.pif RegSvcs.exe PID 1980 set thread context of 1468 1980 voggchu.pif RegSvcs.exe PID 4380 set thread context of 4020 4380 voggchu.pif RegSvcs.exe PID 2508 set thread context of 4424 2508 voggchu.pif RegSvcs.exe PID 1624 set thread context of 4032 1624 voggchu.pif RegSvcs.exe PID 956 set thread context of 4420 956 voggchu.pif RegSvcs.exe PID 3832 set thread context of 4944 3832 voggchu.pif RegSvcs.exe PID 2544 set thread context of 5088 2544 voggchu.pif RegSvcs.exe PID 1152 set thread context of 4468 1152 voggchu.pif RegSvcs.exe PID 3868 set thread context of 2344 3868 voggchu.pif RegSvcs.exe PID 2092 set thread context of 2676 2092 voggchu.pif RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry class 25 IoCs
Processes:
voggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifdescription ioc process Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000_Classes\Local Settings voggchu.pif -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
voggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifvoggchu.pifpid process 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2252 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 2044 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 1468 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 4336 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif 744 voggchu.pif -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifRegSvcs.exeWScript.exevoggchu.pifdescription pid process target process PID 5068 wrote to memory of 2252 5068 ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exe voggchu.pif PID 5068 wrote to memory of 2252 5068 ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exe voggchu.pif PID 5068 wrote to memory of 2252 5068 ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exe voggchu.pif PID 2252 wrote to memory of 100 2252 voggchu.pif RegSvcs.exe PID 2252 wrote to memory of 100 2252 voggchu.pif RegSvcs.exe PID 2252 wrote to memory of 100 2252 voggchu.pif RegSvcs.exe PID 2252 wrote to memory of 100 2252 voggchu.pif RegSvcs.exe PID 2252 wrote to memory of 100 2252 voggchu.pif RegSvcs.exe PID 100 wrote to memory of 4264 100 RegSvcs.exe Host.exe PID 100 wrote to memory of 4264 100 RegSvcs.exe Host.exe PID 100 wrote to memory of 4264 100 RegSvcs.exe Host.exe PID 2252 wrote to memory of 1268 2252 voggchu.pif WScript.exe PID 2252 wrote to memory of 1268 2252 voggchu.pif WScript.exe PID 2252 wrote to memory of 1268 2252 voggchu.pif WScript.exe PID 1268 wrote to memory of 2044 1268 WScript.exe voggchu.pif PID 1268 wrote to memory of 2044 1268 WScript.exe voggchu.pif PID 1268 wrote to memory of 2044 1268 WScript.exe voggchu.pif PID 2044 wrote to memory of 1160 2044 voggchu.pif RegSvcs.exe PID 2044 wrote to memory of 1160 2044 voggchu.pif RegSvcs.exe PID 2044 wrote to memory of 1160 2044 voggchu.pif RegSvcs.exe PID 2044 wrote to memory of 1160 2044 voggchu.pif RegSvcs.exe PID 2044 wrote to memory of 1160 2044 voggchu.pif RegSvcs.exe PID 1160 wrote to memory of 1220 1160 RegSvcs.exe Host.exe PID 1160 wrote to memory of 1220 1160 RegSvcs.exe Host.exe PID 1160 wrote to memory of 1220 1160 RegSvcs.exe Host.exe PID 2044 wrote to memory of 3048 2044 voggchu.pif WScript.exe PID 2044 wrote to memory of 3048 2044 voggchu.pif WScript.exe PID 2044 wrote to memory of 3048 2044 voggchu.pif WScript.exe PID 3048 wrote to memory of 1468 3048 WScript.exe voggchu.pif PID 3048 wrote to memory of 1468 3048 WScript.exe voggchu.pif PID 3048 wrote to memory of 1468 3048 WScript.exe voggchu.pif PID 1468 wrote to memory of 1356 1468 voggchu.pif RegSvcs.exe PID 1468 wrote to memory of 1356 1468 voggchu.pif RegSvcs.exe PID 1468 wrote to memory of 1356 1468 voggchu.pif RegSvcs.exe PID 1468 wrote to memory of 1356 1468 voggchu.pif RegSvcs.exe PID 1468 wrote to memory of 1356 1468 voggchu.pif RegSvcs.exe PID 1356 wrote to memory of 4940 1356 RegSvcs.exe Host.exe PID 1356 wrote to memory of 4940 1356 RegSvcs.exe Host.exe PID 1356 wrote to memory of 4940 1356 RegSvcs.exe Host.exe PID 1468 wrote to memory of 3964 1468 voggchu.pif WScript.exe PID 1468 wrote to memory of 3964 1468 voggchu.pif WScript.exe PID 1468 wrote to memory of 3964 1468 voggchu.pif WScript.exe PID 3964 wrote to memory of 4336 3964 WScript.exe voggchu.pif PID 3964 wrote to memory of 4336 3964 WScript.exe voggchu.pif PID 3964 wrote to memory of 4336 3964 WScript.exe voggchu.pif PID 4336 wrote to memory of 3456 4336 voggchu.pif RegSvcs.exe PID 4336 wrote to memory of 3456 4336 voggchu.pif RegSvcs.exe PID 4336 wrote to memory of 3456 4336 voggchu.pif RegSvcs.exe PID 4336 wrote to memory of 3456 4336 voggchu.pif RegSvcs.exe PID 4336 wrote to memory of 3456 4336 voggchu.pif RegSvcs.exe PID 3456 wrote to memory of 3524 3456 RegSvcs.exe Host.exe PID 3456 wrote to memory of 3524 3456 RegSvcs.exe Host.exe PID 3456 wrote to memory of 3524 3456 RegSvcs.exe Host.exe PID 4336 wrote to memory of 3376 4336 voggchu.pif WScript.exe PID 4336 wrote to memory of 3376 4336 voggchu.pif WScript.exe PID 4336 wrote to memory of 3376 4336 voggchu.pif WScript.exe PID 3376 wrote to memory of 744 3376 WScript.exe voggchu.pif PID 3376 wrote to memory of 744 3376 WScript.exe voggchu.pif PID 3376 wrote to memory of 744 3376 WScript.exe voggchu.pif PID 744 wrote to memory of 4236 744 voggchu.pif RegSvcs.exe PID 744 wrote to memory of 4236 744 voggchu.pif RegSvcs.exe PID 744 wrote to memory of 4236 744 voggchu.pif RegSvcs.exe PID 744 wrote to memory of 4236 744 voggchu.pif RegSvcs.exe PID 744 wrote to memory of 4236 744 voggchu.pif RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exe"C:\Users\Admin\AppData\Local\Temp\ee61ac3cd6ac0319af2ca16d292464c08c018c15cd54f48c27df5907c9fca089.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv2⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"3⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv4⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"5⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"5⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv6⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"7⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"8⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"7⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv8⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"9⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"10⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"9⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv10⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"11⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"12⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"11⤵
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv12⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"13⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"14⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"13⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv14⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"15⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"16⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"15⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv16⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"17⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"18⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"17⤵
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv18⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"19⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"20⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"19⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv20⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"21⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"22⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"21⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv22⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"23⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"24⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"23⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv24⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"25⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"26⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"25⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv26⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"27⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"28⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"27⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv28⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"29⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"30⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"29⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv30⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"31⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"32⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"31⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv32⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"33⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"34⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"33⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv34⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"35⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"36⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"35⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv36⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"37⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"38⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"37⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv38⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"39⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"40⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"39⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv40⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"41⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"42⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"41⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv42⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"43⤵
- Executes dropped EXE
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"44⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"43⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv44⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"46⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"45⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv46⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"48⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"47⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv48⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"50⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"49⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv50⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Modifies registry class
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"51⤵
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"52⤵
-
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Roaming\10_45\run.vbs"51⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif"C:\Users\Admin\AppData\Roaming\10_45\voggchu.pif" bdtfjhrh.onv52⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"C:\Users\Admin\AppData\Local\Temp\RegSvcs.exe"53⤵
- Checks computer location settings
-
C:\Users\Admin\AppData\Roaming\Install\Host.exe"C:\Users\Admin\AppData\Roaming\Install\Host.exe"54⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Host.exe.logFilesize
142B
MD58c0458bb9ea02d50565175e38d577e35
SHA1f0b50702cd6470f3c17d637908f83212fdbdb2f2
SHA256c578e86db701b9afa3626e804cf434f9d32272ff59fb32fa9a51835e5a148b53
SHA512804a47494d9a462ffa6f39759480700ecbe5a7f3a15ec3a6330176ed9c04695d2684bf6bf85ab86286d52e7b727436d0bb2e8da96e20d47740b5ce3f856b5d0f
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Local\Temp\RegSvcs.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\10_45\bdtfjhrh.onvFilesize
192.5MB
MD51f67b14f1e3d91623334d0211014143e
SHA1b8d10a303e5677b4697165f0045215aa46d344cf
SHA2567e77fc5a53f8ce7af043adb4b2f55a7aa7cf85aa5b3cb287ffb50bc00aa59e8c
SHA512361882dd25c1ebc3266d8370ccde986a1b32784fcd6ba7f41cb2bff8987e32ef8e23734be087ebcbdced12d33b5af197c04275cea1651be61254c5f569415a90
-
C:\Users\Admin\AppData\Roaming\10_45\ojmxr.docxFilesize
52KB
MD5b41c2e55f46fe2261e8c59c5c80fc17f
SHA1bce0647980cac6bbe3e5f4d30f0e0ba6851a756e
SHA25652aa0d9fe3a2c181cf6cdf03fa13b4ce46c4316e9f92047589dd64d7e421f51a
SHA512bf571dc910501162b080e7f728224111875a22f69b35b99b3c0cb6f29415de678f621b8c9106d0a0502d625ef559fd61b9595371e38b32f8cc54ccf646d2f215
-
C:\Users\Admin\AppData\Roaming\10_45\run.vbsFilesize
129B
MD5a503eadaf1a2e93f824f0eb4d94d6c2d
SHA18a8177c02ef05b5acb97a8d4df1274a3489cb11a
SHA256672ca4a9d388f0ad1c0ae4f0114b974a846e90e3f2c02d0c6d76a6147ead5148
SHA51240e35e0c60c56d7652663b7fcae292f87391c57df8ef3c3b483487bc706b154ec86d398cceb46b5ede9f3ab9f2b06c3e4a3db49d37144829b0d7d98d5aeccd1e
-
C:\Users\Admin\AppData\Roaming\10_45\uasjqkqoon.svtFilesize
321KB
MD5ac2e9173e418ac2218af1691880832d8
SHA105bcf9e120a5e1669ff2e61d81c4ec4243f1cc04
SHA2568810235c647c340f4acaa66ed83a808de14d48df208d6417e559016e4b8513f5
SHA5121376ea8009ce53f0df7b10bd3371859020b65940d5dc3014a037898150ec26458857128eff9af9205eed4456b49fa5d401b21095015bdad658ca0952a0719f51
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\10_45\voggchu.pifFilesize
1.7MB
MD5dd3466f64841cf21fc31f63f03dbfd29
SHA13878c8e52203d792c6f672595f7c78ab27ce3f04
SHA2564fe3004208ed574521992dd1ba3d900b75a0f02f1d63ba1e531d309e85ffa06b
SHA512adf3fe8378f7da5ba278db9a1df4cc7b5cff12398ec39ee7037382ebf57897de8bec72be64b5e7332bdb7ed865788dcb6ef4ceda6654e1153d39fe84b011b057
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
C:\Users\Admin\AppData\Roaming\Install\Host.exeFilesize
44KB
MD59d352bc46709f0cb5ec974633a0c3c94
SHA11969771b2f022f9a86d77ac4d4d239becdf08d07
SHA2562c1eeb7097023c784c2bd040a2005a5070ed6f3a4abf13929377a9e39fab1390
SHA51213c714244ec56beeb202279e4109d59c2a43c3cf29f90a374a751c04fd472b45228ca5a0178f41109ed863dbd34e0879e4a21f5e38ae3d89559c57e6be990a9b
-
memory/100-146-0x0000000001330000-0x000000000185A000-memory.dmpFilesize
5.2MB
-
memory/100-142-0x0000000001330000-0x000000000185A000-memory.dmpFilesize
5.2MB
-
memory/100-139-0x000000000133242D-mapping.dmp
-
memory/100-138-0x0000000001330000-0x000000000185A000-memory.dmpFilesize
5.2MB
-
memory/400-298-0x0000000000430000-0x0000000000B28000-memory.dmpFilesize
7.0MB
-
memory/400-299-0x0000000000430000-0x0000000000B28000-memory.dmpFilesize
7.0MB
-
memory/400-296-0x000000000043242D-mapping.dmp
-
memory/400-295-0x0000000000430000-0x0000000000B28000-memory.dmpFilesize
7.0MB
-
memory/680-201-0x0000000000000000-mapping.dmp
-
memory/744-192-0x0000000000000000-mapping.dmp
-
memory/760-314-0x00000000013A0000-0x0000000001AAB000-memory.dmpFilesize
7.0MB
-
memory/760-312-0x00000000013A242D-mapping.dmp
-
memory/760-311-0x00000000013A0000-0x0000000001AAB000-memory.dmpFilesize
7.0MB
-
memory/760-316-0x00000000013A0000-0x0000000001AAB000-memory.dmpFilesize
7.0MB
-
memory/1152-308-0x0000000000000000-mapping.dmp
-
memory/1160-158-0x0000000001300000-0x0000000001946000-memory.dmpFilesize
6.3MB
-
memory/1160-155-0x000000000130242D-mapping.dmp
-
memory/1160-164-0x0000000001300000-0x0000000001946000-memory.dmpFilesize
6.3MB
-
memory/1160-154-0x0000000001300000-0x0000000001946000-memory.dmpFilesize
6.3MB
-
memory/1184-213-0x0000000000F00000-0x000000000150E000-memory.dmpFilesize
6.1MB
-
memory/1184-211-0x0000000000F00000-0x000000000150E000-memory.dmpFilesize
6.1MB
-
memory/1184-208-0x0000000000F0242D-mapping.dmp
-
memory/1184-207-0x0000000000F00000-0x000000000150E000-memory.dmpFilesize
6.1MB
-
memory/1220-160-0x0000000000000000-mapping.dmp
-
memory/1268-301-0x0000000000000000-mapping.dmp
-
memory/1268-149-0x0000000000000000-mapping.dmp
-
memory/1288-226-0x0000000000D00000-0x0000000001414000-memory.dmpFilesize
7.1MB
-
memory/1288-224-0x0000000000D00000-0x0000000001414000-memory.dmpFilesize
7.1MB
-
memory/1288-221-0x0000000000D0242D-mapping.dmp
-
memory/1288-220-0x0000000000D00000-0x0000000001414000-memory.dmpFilesize
7.1MB
-
memory/1356-257-0x0000000000000000-mapping.dmp
-
memory/1356-176-0x00000000005C0000-0x0000000000A77000-memory.dmpFilesize
4.7MB
-
memory/1356-168-0x00000000005C0000-0x0000000000A77000-memory.dmpFilesize
4.7MB
-
memory/1356-169-0x00000000005C242D-mapping.dmp
-
memory/1356-172-0x00000000005C0000-0x0000000000A77000-memory.dmpFilesize
4.7MB
-
memory/1468-329-0x0000000000700000-0x0000000000DC1000-memory.dmpFilesize
6.8MB
-
memory/1468-328-0x0000000000700000-0x0000000000DC1000-memory.dmpFilesize
6.8MB
-
memory/1468-166-0x0000000000000000-mapping.dmp
-
memory/1468-326-0x0000000000700000-0x0000000000DC1000-memory.dmpFilesize
6.8MB
-
memory/1508-315-0x0000000000000000-mapping.dmp
-
memory/1568-323-0x0000000000000000-mapping.dmp
-
memory/1588-244-0x0000000000000000-mapping.dmp
-
memory/1636-309-0x0000000000000000-mapping.dmp
-
memory/1716-302-0x0000000000000000-mapping.dmp
-
memory/1824-283-0x0000000000000000-mapping.dmp
-
memory/1944-282-0x0000000000000000-mapping.dmp
-
memory/1960-310-0x0000000000000000-mapping.dmp
-
memory/1984-253-0x0000000000000000-mapping.dmp
-
memory/2044-152-0x0000000000000000-mapping.dmp
-
memory/2068-278-0x0000000000000000-mapping.dmp
-
memory/2072-205-0x0000000000000000-mapping.dmp
-
memory/2124-292-0x0000000000000000-mapping.dmp
-
memory/2232-247-0x000000000090242D-mapping.dmp
-
memory/2232-252-0x0000000000900000-0x0000000000F55000-memory.dmpFilesize
6.3MB
-
memory/2232-250-0x0000000000900000-0x0000000000F55000-memory.dmpFilesize
6.3MB
-
memory/2232-246-0x0000000000900000-0x0000000000F55000-memory.dmpFilesize
6.3MB
-
memory/2252-132-0x0000000000000000-mapping.dmp
-
memory/2344-362-0x0000000000F00000-0x00000000014E2000-memory.dmpFilesize
5.9MB
-
memory/2424-230-0x0000000000000000-mapping.dmp
-
memory/2544-300-0x0000000000000000-mapping.dmp
-
memory/2564-234-0x000000000040242D-mapping.dmp
-
memory/2564-233-0x0000000000400000-0x0000000000AC1000-memory.dmpFilesize
6.8MB
-
memory/2564-239-0x0000000000400000-0x0000000000AC1000-memory.dmpFilesize
6.8MB
-
memory/2564-237-0x0000000000400000-0x0000000000AC1000-memory.dmpFilesize
6.8MB
-
memory/2608-270-0x0000000000000000-mapping.dmp
-
memory/2676-366-0x0000000000500000-0x0000000000BDE000-memory.dmpFilesize
6.9MB
-
memory/3004-243-0x0000000000000000-mapping.dmp
-
memory/3028-214-0x0000000000000000-mapping.dmp
-
memory/3048-165-0x0000000000000000-mapping.dmp
-
memory/3304-217-0x0000000000000000-mapping.dmp
-
memory/3376-191-0x0000000000000000-mapping.dmp
-
memory/3456-185-0x0000000000D00000-0x00000000011F1000-memory.dmpFilesize
4.9MB
-
memory/3456-182-0x0000000000D0242D-mapping.dmp
-
memory/3456-181-0x0000000000D00000-0x00000000011F1000-memory.dmpFilesize
4.9MB
-
memory/3456-188-0x0000000000D00000-0x00000000011F1000-memory.dmpFilesize
4.9MB
-
memory/3524-187-0x0000000000000000-mapping.dmp
-
memory/3556-218-0x0000000000000000-mapping.dmp
-
memory/3576-320-0x000000000090242D-mapping.dmp
-
memory/3576-319-0x0000000000900000-0x0000000000E46000-memory.dmpFilesize
5.3MB
-
memory/3576-322-0x0000000000900000-0x0000000000E46000-memory.dmpFilesize
5.3MB
-
memory/3576-324-0x0000000000900000-0x0000000000E46000-memory.dmpFilesize
5.3MB
-
memory/3960-325-0x0000000000000000-mapping.dmp
-
memory/3964-178-0x0000000000000000-mapping.dmp
-
memory/4020-333-0x0000000000920000-0x0000000000DD7000-memory.dmpFilesize
4.7MB
-
memory/4020-332-0x0000000000920000-0x0000000000DD7000-memory.dmpFilesize
4.7MB
-
memory/4020-330-0x0000000000920000-0x0000000000DD7000-memory.dmpFilesize
4.7MB
-
memory/4032-338-0x0000000000770000-0x0000000000E4E000-memory.dmpFilesize
6.9MB
-
memory/4032-341-0x0000000000770000-0x0000000000E4E000-memory.dmpFilesize
6.9MB
-
memory/4032-340-0x0000000000770000-0x0000000000E4E000-memory.dmpFilesize
6.9MB
-
memory/4092-269-0x0000000000000000-mapping.dmp
-
memory/4220-204-0x0000000000000000-mapping.dmp
-
memory/4228-286-0x000000000115242D-mapping.dmp
-
memory/4228-289-0x0000000001150000-0x00000000017B8000-memory.dmpFilesize
6.4MB
-
memory/4228-285-0x0000000001150000-0x00000000017B8000-memory.dmpFilesize
6.4MB
-
memory/4228-291-0x0000000001150000-0x00000000017B8000-memory.dmpFilesize
6.4MB
-
memory/4236-198-0x0000000001320000-0x0000000001A72000-memory.dmpFilesize
7.3MB
-
memory/4236-200-0x0000000001320000-0x0000000001A72000-memory.dmpFilesize
7.3MB
-
memory/4236-195-0x000000000132242D-mapping.dmp
-
memory/4236-194-0x0000000001320000-0x0000000001A72000-memory.dmpFilesize
7.3MB
-
memory/4252-240-0x0000000000000000-mapping.dmp
-
memory/4264-150-0x00000000054A0000-0x00000000054DC000-memory.dmpFilesize
240KB
-
memory/4264-148-0x0000000000BA0000-0x0000000000BAE000-memory.dmpFilesize
56KB
-
memory/4264-144-0x0000000000000000-mapping.dmp
-
memory/4308-227-0x0000000000000000-mapping.dmp
-
memory/4336-179-0x0000000000000000-mapping.dmp
-
memory/4380-260-0x0000000000D0242D-mapping.dmp
-
memory/4380-265-0x0000000000D00000-0x00000000011B1000-memory.dmpFilesize
4.7MB
-
memory/4380-263-0x0000000000D00000-0x00000000011B1000-memory.dmpFilesize
4.7MB
-
memory/4380-259-0x0000000000D00000-0x00000000011B1000-memory.dmpFilesize
4.7MB
-
memory/4416-293-0x0000000000000000-mapping.dmp
-
memory/4420-345-0x0000000000700000-0x0000000000E08000-memory.dmpFilesize
7.0MB
-
memory/4420-344-0x0000000000700000-0x0000000000E08000-memory.dmpFilesize
7.0MB
-
memory/4420-342-0x0000000000700000-0x0000000000E08000-memory.dmpFilesize
7.0MB
-
memory/4424-334-0x0000000000780000-0x0000000000E0E000-memory.dmpFilesize
6.6MB
-
memory/4424-336-0x0000000000780000-0x0000000000E0E000-memory.dmpFilesize
6.6MB
-
memory/4424-337-0x0000000000780000-0x0000000000E0E000-memory.dmpFilesize
6.6MB
-
memory/4468-367-0x0000000000990000-0x0000000000EE5000-memory.dmpFilesize
5.3MB
-
memory/4468-357-0x0000000000990000-0x0000000000EE5000-memory.dmpFilesize
5.3MB
-
memory/4480-266-0x0000000000000000-mapping.dmp
-
memory/4688-231-0x0000000000000000-mapping.dmp
-
memory/4724-273-0x000000000090242D-mapping.dmp
-
memory/4724-280-0x0000000000900000-0x0000000000E18000-memory.dmpFilesize
5.1MB
-
memory/4724-272-0x0000000000900000-0x0000000000E18000-memory.dmpFilesize
5.1MB
-
memory/4724-276-0x0000000000900000-0x0000000000E18000-memory.dmpFilesize
5.1MB
-
memory/4920-317-0x0000000000000000-mapping.dmp
-
memory/4924-303-0x0000000000BB0000-0x000000000112B000-memory.dmpFilesize
5.5MB
-
memory/4924-306-0x0000000000BB0000-0x000000000112B000-memory.dmpFilesize
5.5MB
-
memory/4924-307-0x0000000000BB0000-0x000000000112B000-memory.dmpFilesize
5.5MB
-
memory/4924-304-0x0000000000BB242D-mapping.dmp
-
memory/4940-174-0x0000000000000000-mapping.dmp
-
memory/4944-346-0x0000000000550000-0x0000000000BAB000-memory.dmpFilesize
6.4MB
-
memory/4944-349-0x0000000000550000-0x0000000000BAB000-memory.dmpFilesize
6.4MB
-
memory/4944-358-0x0000000000550000-0x0000000000BAB000-memory.dmpFilesize
6.4MB
-
memory/4976-294-0x0000000000000000-mapping.dmp
-
memory/4988-256-0x0000000000000000-mapping.dmp
-
memory/5016-318-0x0000000000000000-mapping.dmp
-
memory/5088-353-0x0000000000500000-0x0000000000A2A000-memory.dmpFilesize
5.2MB