4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7

Analysis

max time kernel
156s
max time network
53s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 21:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
Size

255KB
MD5

68abf81d82533a16dd859e2578d7be6c
SHA1

ae6fd12bbfdee685b31238af4632e0382d65e974
SHA256

4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7
SHA512

c1ef75829f31c4a23bdfaa4b22dda8e2c87c75eac46f8042c09066448f39854866fd6d046168ee1a357a9c3916965cbdb18fcc6b88e60e1ac33cda84d02fc590
SSDEEP

3072:MMDb50WrZa8jCgae5+VQkGdUQFDxePZ2SBaQJXkNRtXlNGKaUIQW/qlQBG3mmTJw:1xlZam+akqx6YQJXcNlEHUIQeE3mmBIt

Score

10^/10

evasion persistence spyware stealer trojan upx

Malware Config

Signatures

Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1"	hozzilahdr.exe

Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1158

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0"	hozzilahdr.exe

Windows security bypass 2 TTPs 5 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	hozzilahdr.exe

Disables RegEdit via registry modification 1 IoCs

evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	hozzilahdr.exe

Executes dropped EXE 6 IoCs

pid	Process
544	hozzilahdr.exe
700	neeohenwkniefsg.exe
812	uwttoztd.exe
760	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
1736	uwttoztd.exe

Modifies Installed Components in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components	explorer.exe

UPX packed file 39 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0008000000005c51-55.dat	upx
behavioral1/files/0x0008000000005c51-57.dat	upx
behavioral1/files/0x000a0000000122f3-58.dat	upx
behavioral1/files/0x000a0000000122f3-61.dat	upx
behavioral1/memory/824-62-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/824-65-0x0000000002F30000-0x0000000002FD0000-memory.dmp	upx
behavioral1/files/0x0009000000012307-64.dat	upx
behavioral1/files/0x0008000000005c51-68.dat	upx
behavioral1/files/0x000a0000000122f3-71.dat	upx
behavioral1/files/0x0009000000012307-70.dat	upx
behavioral1/files/0x000800000001230b-77.dat	upx
behavioral1/files/0x000800000001230b-75.dat	upx
behavioral1/files/0x0009000000012307-79.dat	upx
behavioral1/files/0x000800000001230b-83.dat	upx
behavioral1/files/0x000800000001230b-81.dat	upx
behavioral1/files/0x000800000001230b-73.dat	upx
behavioral1/memory/544-67-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0009000000012307-87.dat	upx
behavioral1/files/0x0009000000012307-85.dat	upx
behavioral1/files/0x00020000000001bf-90.dat	upx
behavioral1/files/0x00020000000001bf-89.dat	upx
behavioral1/memory/824-92-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/700-94-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1376-97-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/760-96-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1736-98-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/812-95-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/files/0x0002000000003d25-102.dat	upx
behavioral1/files/0x00070000000133cf-105.dat	upx
behavioral1/files/0x00070000000133cf-106.dat	upx
behavioral1/files/0x00070000000133f0-107.dat	upx
behavioral1/memory/544-108-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/700-109-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/812-110-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/760-111-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1376-112-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1736-113-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/1736-116-0x0000000000400000-0x00000000004A0000-memory.dmp	upx
behavioral1/memory/812-115-0x0000000000400000-0x00000000004A0000-memory.dmp	upx

Loads dropped DLL 6 IoCs

pid	Process
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
744	cmd.exe
544	hozzilahdr.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Windows security modification 2 TTPs 6 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirstRunDisabled = "1"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1"	hozzilahdr.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run	neeohenwkniefsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\aacqnzio = "hozzilahdr.exe"	neeohenwkniefsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\giglnmrm = "neeohenwkniefsg.exe"	neeohenwkniefsg.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "pfbaseawafupc.exe"	neeohenwkniefsg.exe

Enumerates connected drives 3 TTPs 64 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\a:	hozzilahdr.exe
File opened (read-only)	\??\y:	hozzilahdr.exe
File opened (read-only)	\??\b:	uwttoztd.exe
File opened (read-only)	\??\l:	uwttoztd.exe
File opened (read-only)	\??\k:	uwttoztd.exe
File opened (read-only)	\??\j:	hozzilahdr.exe
File opened (read-only)	\??\q:	hozzilahdr.exe
File opened (read-only)	\??\m:	uwttoztd.exe
File opened (read-only)	\??\h:	uwttoztd.exe
File opened (read-only)	\??\t:	uwttoztd.exe
File opened (read-only)	\??\u:	uwttoztd.exe
File opened (read-only)	\??\g:	uwttoztd.exe
File opened (read-only)	\??\v:	uwttoztd.exe
File opened (read-only)	\??\f:	uwttoztd.exe
File opened (read-only)	\??\y:	uwttoztd.exe
File opened (read-only)	\??\l:	uwttoztd.exe
File opened (read-only)	\??\e:	uwttoztd.exe
File opened (read-only)	\??\r:	uwttoztd.exe
File opened (read-only)	\??\v:	hozzilahdr.exe
File opened (read-only)	\??\x:	uwttoztd.exe
File opened (read-only)	\??\q:	uwttoztd.exe
File opened (read-only)	\??\y:	uwttoztd.exe
File opened (read-only)	\??\z:	uwttoztd.exe
File opened (read-only)	\??\x:	hozzilahdr.exe
File opened (read-only)	\??\j:	uwttoztd.exe
File opened (read-only)	\??\k:	uwttoztd.exe
File opened (read-only)	\??\x:	uwttoztd.exe
File opened (read-only)	\??\e:	uwttoztd.exe
File opened (read-only)	\??\s:	uwttoztd.exe
File opened (read-only)	\??\t:	uwttoztd.exe
File opened (read-only)	\??\s:	hozzilahdr.exe
File opened (read-only)	\??\o:	uwttoztd.exe
File opened (read-only)	\??\p:	uwttoztd.exe
File opened (read-only)	\??\p:	uwttoztd.exe
File opened (read-only)	\??\u:	uwttoztd.exe
File opened (read-only)	\??\e:	hozzilahdr.exe
File opened (read-only)	\??\t:	hozzilahdr.exe
File opened (read-only)	\??\i:	uwttoztd.exe
File opened (read-only)	\??\o:	hozzilahdr.exe
File opened (read-only)	\??\a:	uwttoztd.exe
File opened (read-only)	\??\b:	hozzilahdr.exe
File opened (read-only)	\??\o:	uwttoztd.exe
File opened (read-only)	\??\m:	hozzilahdr.exe
File opened (read-only)	\??\n:	hozzilahdr.exe
File opened (read-only)	\??\w:	hozzilahdr.exe
File opened (read-only)	\??\z:	hozzilahdr.exe
File opened (read-only)	\??\r:	uwttoztd.exe
File opened (read-only)	\??\v:	uwttoztd.exe
File opened (read-only)	\??\g:	uwttoztd.exe
File opened (read-only)	\??\h:	hozzilahdr.exe
File opened (read-only)	\??\j:	uwttoztd.exe
File opened (read-only)	\??\i:	uwttoztd.exe
File opened (read-only)	\??\l:	hozzilahdr.exe
File opened (read-only)	\??\b:	uwttoztd.exe
File opened (read-only)	\??\f:	uwttoztd.exe
File opened (read-only)	\??\f:	hozzilahdr.exe
File opened (read-only)	\??\n:	uwttoztd.exe
File opened (read-only)	\??\q:	uwttoztd.exe
File opened (read-only)	\??\s:	uwttoztd.exe
File opened (read-only)	\??\z:	uwttoztd.exe
File opened (read-only)	\??\a:	uwttoztd.exe
File opened (read-only)	\??\n:	uwttoztd.exe
File opened (read-only)	\??\w:	uwttoztd.exe
File opened (read-only)	\??\p:	hozzilahdr.exe

Modifies WinLogon 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCScan = "0"	hozzilahdr.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\SFCDisable = "4294967197"	hozzilahdr.exe

AutoIT Executable 15 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/824-62-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/824-92-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/700-94-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1376-97-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/760-96-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1736-98-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/812-95-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/544-108-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/700-109-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/812-110-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/760-111-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1376-112-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1736-113-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/1736-116-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe
behavioral1/memory/812-115-0x0000000000400000-0x00000000004A0000-memory.dmp	autoit_exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\hozzilahdr.exe	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
File opened for modification	C:\Windows\SysWOW64\hozzilahdr.exe	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
File created	C:\Windows\SysWOW64\neeohenwkniefsg.exe	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
File opened for modification	C:\Windows\SysWOW64\uwttoztd.exe	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
File created	C:\Windows\SysWOW64\pfbaseawafupc.exe	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
File opened for modification	C:\Windows\SysWOW64\neeohenwkniefsg.exe	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
File created	C:\Windows\SysWOW64\uwttoztd.exe	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
File opened for modification	C:\Windows\SysWOW64\pfbaseawafupc.exe	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
File opened for modification	C:\Windows\SysWOW64\msvbvm60.dll	hozzilahdr.exe

Drops file in Program Files directory 28 IoCs

description	ioc	Process
File opened for modification	\??\c:\Program Files\SyncPing.doc.exe	uwttoztd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	uwttoztd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	uwttoztd.exe
File created	\??\c:\Program Files\ConnectUninstall.doc.exe	uwttoztd.exe
File opened for modification	C:\Program Files\SyncPing.doc.exe	uwttoztd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	uwttoztd.exe
File opened for modification	C:\Program Files\ConnectUninstall.doc.exe	uwttoztd.exe
File created	\??\c:\Program Files\SyncPing.doc.exe	uwttoztd.exe
File opened for modification	C:\Program Files\SyncPing.doc.exe	uwttoztd.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	uwttoztd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.nal	uwttoztd.exe
File opened for modification	C:\Program Files\ConnectUninstall.doc.exe	uwttoztd.exe
File opened for modification	C:\Program Files\SyncPing.nal	uwttoztd.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	uwttoztd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	uwttoztd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.nal	uwttoztd.exe
File opened for modification	C:\Program Files\SyncPing.nal	uwttoztd.exe
File created	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	uwttoztd.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	uwttoztd.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	uwttoztd.exe
File opened for modification	\??\c:\Program Files\ConnectUninstall.doc.exe	uwttoztd.exe
File opened for modification	C:\Program Files\ConnectUninstall.nal	uwttoztd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe	uwttoztd.exe
File opened for modification	C:\Program Files\ConnectUninstall.nal	uwttoztd.exe
File opened for modification	\??\c:\Program Files\SyncPing.doc.exe	uwttoztd.exe
File opened for modification	C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	uwttoztd.exe
File opened for modification	\??\c:\Program Files\ConnectUninstall.doc.exe	uwttoztd.exe
File opened for modification	\??\c:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe	uwttoztd.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\mydoc.rtf	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
File opened for modification	C:\Windows\mydoc.rtf	WINWORD.EXE
File created	C:\Windows\~$mydoc.rtf	WINWORD.EXE
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	WINWORD.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Office loads VBA resources, possible macro or embedded object present

Modifies Internet Explorer settings 1 TTPs 33 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105"	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running"	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55"	WINWORD.EXE
Set value (int)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch	explorer.exe
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit"	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar	WINWORD.EXE
Set value (str)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes"	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command	WINWORD.EXE

Modifies registry class 64 IoCs

description	ioc	Process
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\ShellEx	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14\ = "C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings	explorer.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" /p %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\""	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command	WINWORD.EXE
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.vbs\ = "txtfile"	hozzilahdr.exe
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.bat\ = "txtfile"	hozzilahdr.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.wsc\ = "txtfile"	hozzilahdr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Old Icon\mhtmlfile	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\""	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32\ThreadingModel = "Apartment"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Key deleted	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ = "&Open"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit	WINWORD.EXE
Key created	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.WSF\ = "txtfile"	hozzilahdr.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Print\command	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1"	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\CLV.Classes\Com3 = "2EB7B02D4495389F53B8B9A733EAD7BB"	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots	explorer.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit	WINWORD.EXE
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde"	WINWORD.EXE
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command	WINWORD.EXE

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
980	WINWORD.EXE

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
700	neeohenwkniefsg.exe
700	neeohenwkniefsg.exe
700	neeohenwkniefsg.exe
700	neeohenwkniefsg.exe
700	neeohenwkniefsg.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
812	uwttoztd.exe
812	uwttoztd.exe
812	uwttoztd.exe
812	uwttoztd.exe
544	hozzilahdr.exe
544	hozzilahdr.exe
544	hozzilahdr.exe
544	hozzilahdr.exe
544	hozzilahdr.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
700	neeohenwkniefsg.exe
1736	uwttoztd.exe
1736	uwttoztd.exe
1736	uwttoztd.exe
1736	uwttoztd.exe
700	neeohenwkniefsg.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
700	neeohenwkniefsg.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
700	neeohenwkniefsg.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
700	neeohenwkniefsg.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
700	neeohenwkniefsg.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
700	neeohenwkniefsg.exe
1376	pfbaseawafupc.exe

Suspicious use of AdjustPrivilegeToken 20 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: 33	1636	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1636	AUDIODG.EXE
Token: 33	1636	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1636	AUDIODG.EXE
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe
Token: SeShutdownPrivilege	1588	explorer.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
544	hozzilahdr.exe
544	hozzilahdr.exe
544	hozzilahdr.exe
700	neeohenwkniefsg.exe
700	neeohenwkniefsg.exe
700	neeohenwkniefsg.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
812	uwttoztd.exe
812	uwttoztd.exe
812	uwttoztd.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
1376	pfbaseawafupc.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1736	uwttoztd.exe
1588	explorer.exe
1588	explorer.exe
1736	uwttoztd.exe
1736	uwttoztd.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe

Suspicious use of SendNotifyMessage 40 IoCs

pid	Process
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
544	hozzilahdr.exe
544	hozzilahdr.exe
544	hozzilahdr.exe
700	neeohenwkniefsg.exe
700	neeohenwkniefsg.exe
700	neeohenwkniefsg.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
760	pfbaseawafupc.exe
812	uwttoztd.exe
812	uwttoztd.exe
812	uwttoztd.exe
1588	explorer.exe
1736	uwttoztd.exe
1588	explorer.exe
1736	uwttoztd.exe
1736	uwttoztd.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe
1588	explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
980	WINWORD.EXE
980	WINWORD.EXE

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 824 wrote to memory of 544	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	27
PID 824 wrote to memory of 544	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	27
PID 824 wrote to memory of 544	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	27
PID 824 wrote to memory of 544	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	27
PID 824 wrote to memory of 700	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	28
PID 824 wrote to memory of 700	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	28
PID 824 wrote to memory of 700	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	28
PID 824 wrote to memory of 700	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	28
PID 824 wrote to memory of 812	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	29
PID 824 wrote to memory of 812	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	29
PID 824 wrote to memory of 812	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	29
PID 824 wrote to memory of 812	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	29
PID 824 wrote to memory of 760	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	30
PID 824 wrote to memory of 760	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	30
PID 824 wrote to memory of 760	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	30
PID 824 wrote to memory of 760	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	30
PID 700 wrote to memory of 744	700	neeohenwkniefsg.exe	31
PID 700 wrote to memory of 744	700	neeohenwkniefsg.exe	31
PID 700 wrote to memory of 744	700	neeohenwkniefsg.exe	31
PID 700 wrote to memory of 744	700	neeohenwkniefsg.exe	31
PID 744 wrote to memory of 1376	744	cmd.exe	34
PID 744 wrote to memory of 1376	744	cmd.exe	34
PID 744 wrote to memory of 1376	744	cmd.exe	34
PID 744 wrote to memory of 1376	744	cmd.exe	34
PID 544 wrote to memory of 1736	544	hozzilahdr.exe	35
PID 544 wrote to memory of 1736	544	hozzilahdr.exe	35
PID 544 wrote to memory of 1736	544	hozzilahdr.exe	35
PID 544 wrote to memory of 1736	544	hozzilahdr.exe	35
PID 824 wrote to memory of 980	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	38
PID 824 wrote to memory of 980	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	38
PID 824 wrote to memory of 980	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	38
PID 824 wrote to memory of 980	824	4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe	38

C:\Users\Admin\AppData\Local\Temp\4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe
"C:\Users\Admin\AppData\Local\Temp\4dd62906a903e885eb8831bb2fb890059d139e93aee6cf4e3fe2a615b374b4a7.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:824
- C:\Windows\SysWOW64\hozzilahdr.exe
  hozzilahdr.exe
  2⤵
  - Modifies visibility of file extensions in Explorer
  - Modifies visiblity of hidden/system files in Explorer
  - Windows security bypass
  - Disables RegEdit via registry modification
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Enumerates connected drives
  - Modifies WinLogon
  - Drops file in System32 directory
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:544
- - C:\Windows\SysWOW64\uwttoztd.exe
    C:\Windows\system32\uwttoztd.exe
    3⤵
    - Executes dropped EXE
    - Enumerates connected drives
    - Drops file in Program Files directory
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:1736
- C:\Windows\SysWOW64\neeohenwkniefsg.exe
  neeohenwkniefsg.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:700
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c pfbaseawafupc.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:744
  - - C:\Windows\SysWOW64\pfbaseawafupc.exe
      pfbaseawafupc.exe
      4⤵
      Executes dropped EXE
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of FindShellTrayWindow
      PID:1376
- C:\Windows\SysWOW64\uwttoztd.exe
  uwttoztd.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in Program Files directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:812
- C:\Windows\SysWOW64\pfbaseawafupc.exe
  pfbaseawafupc.exe
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  PID:760
- C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE
  "C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" /n "C:\Windows\mydoc.rtf"
  2⤵
  - Drops file in Windows directory
  - Modifies Internet Explorer settings
  - Modifies registry class
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of SetWindowsHookEx
  PID:980

C:\Windows\explorer.exe
explorer.exe
1⤵
- Modifies Installed Components in the registry
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1588

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x594
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1636

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Hidden Files and Directories

T1158

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Hidden Files and Directories

T1158

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
dedc778b926b95ce7866d448df63b0dc

SHA1
d9545ed146711060714fde07ffb8d37f01471a1c

SHA256
7723024bfe6434378956a7788cbd92cce77dfb174d921d78cbab22bfbe217650

SHA512
17f5bac5a9ba20941284f09f366c157f28eb3b0c979309a0b5e6b69e181eba15c9d5b1855ef0d48c0a36ee37b4adb2c757a15b6bac18d5efa20171f33d7de624

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLN.DOC.exe

Filesize
255KB

MD5
ab3a673d83870a3e4a8f61ec41052144

SHA1
4e4bc0a29c1986d82d81b9c4fb45061ed0c50959

SHA256
ed2e6ab3ee696e1aec5d4e3bbf677317d7d9dc715d533ff502c7a52d284f1431

SHA512
b22ff8b4e192dea936f243fe908a57693a866fc741bb73c0a5db0ea198292c9dd7a352e7b22674af8e72940403ab3b5d8487d970c3d7bf365e5e77b4e285bdef

Download Submit
C:\Program Files (x86)\Microsoft Office\Office14\1033\PROTTPLV.DOC.exe

Filesize
255KB

MD5
2c8e88555423ace605d68423801605f8

SHA1
8606a9d1a86b5e5618cb9f1a1f36bb9f4f39bb32

SHA256
59672d76a423bfd0a83a4d46a0180d14135abae45a6d5befdbfdbca02bd5e0d3

SHA512
1777c935748627bdeeaf227acd4852b49d67f589be82d22538a2114d68ea2615babfb1f4e8b7a8ca6f116d44ba3f27ce47ef3ee4ec91320dd49a8cd65b015d0e

Download Submit
C:\Program Files\ConnectUninstall.doc.exe

Filesize
255KB

MD5
e52385ed52fa4e24a25c59d88c33c435

SHA1
bdbfc38042b99628f7894a936cae1a2ce6256428

SHA256
8fde0ab5cc0cd8e3eb1b57c59890b1936195e2e20a9d3f9be4d45bbfe495ea07

SHA512
008365c4394fe7094a1a38851aba58b7d67ddbe3fe53fef9adfda028eb00cedfbfd36e5e4020d6617750cb08c14d77a1605657722b1c5576578dbfef4811044c

Download Submit
C:\Program Files\ConnectUninstall.doc.exe

Filesize
255KB

MD5
e52385ed52fa4e24a25c59d88c33c435

SHA1
bdbfc38042b99628f7894a936cae1a2ce6256428

SHA256
8fde0ab5cc0cd8e3eb1b57c59890b1936195e2e20a9d3f9be4d45bbfe495ea07

SHA512
008365c4394fe7094a1a38851aba58b7d67ddbe3fe53fef9adfda028eb00cedfbfd36e5e4020d6617750cb08c14d77a1605657722b1c5576578dbfef4811044c

Download Submit
C:\Program Files\SyncPing.doc.exe

Filesize
255KB

MD5
4b93a526fae8c324b704fddff68aae7f

SHA1
dee7a6d9a9c6befa1f80ce485e7334e6f10b7a82

SHA256
e07625bcffeb6e9257b0dbd37e1f63df11f2f348ee2e77b6a1d0bb2093e2823a

SHA512
1391c36a53f1ebab01a4394f7a29b879cd8c889a83b19ac5351afaa009f532bcbfb4ba521447f44f3daeff21f2cf33cf27b1683fd90d6904a329340190cbf67a

Download Submit
C:\Windows\SysWOW64\hozzilahdr.exe

Filesize
255KB

MD5
8fb46797f1db7eb2e603225c64d4d8ea

SHA1
769380e59b517f0722e98994f6934c43519993d9

SHA256
ead1ae1cf747cfd2a115a1953ac403585803fb7204d0ffbaccb1cb4f493279c2

SHA512
ba9c9a1a75b541a02cd85a246b818682cf6f0ae90391565fef2b67666aa6ae752e2b0342b138576834204ebbf491e6a244fdd8e56453314dea67f2fcaccda791

Download Submit
C:\Windows\SysWOW64\hozzilahdr.exe

Filesize
255KB

MD5
8fb46797f1db7eb2e603225c64d4d8ea

SHA1
769380e59b517f0722e98994f6934c43519993d9

SHA256
ead1ae1cf747cfd2a115a1953ac403585803fb7204d0ffbaccb1cb4f493279c2

SHA512
ba9c9a1a75b541a02cd85a246b818682cf6f0ae90391565fef2b67666aa6ae752e2b0342b138576834204ebbf491e6a244fdd8e56453314dea67f2fcaccda791

Download Submit
C:\Windows\SysWOW64\neeohenwkniefsg.exe

Filesize
255KB

MD5
1e2f446a88bfdfc5885a1aa52589f6b3

SHA1
7e3d1836d454a6aa3994a6407f5263fb79fb2e50

SHA256
c8abc7e39504d3e734f101967582c188b5ffa28518b4a3d5a0a4f9c44425b670

SHA512
2c61eb968acbfb6b9ad8207cdcbe125eb6806c4cf23f037a6f18f5a5b4347560dddb58423d11d2df61d749c7eaa1833596a964d9c0b651c2dbfa11a2c166af4c

Download Submit
C:\Windows\SysWOW64\neeohenwkniefsg.exe

Filesize
255KB

MD5
1e2f446a88bfdfc5885a1aa52589f6b3

SHA1
7e3d1836d454a6aa3994a6407f5263fb79fb2e50

SHA256
c8abc7e39504d3e734f101967582c188b5ffa28518b4a3d5a0a4f9c44425b670

SHA512
2c61eb968acbfb6b9ad8207cdcbe125eb6806c4cf23f037a6f18f5a5b4347560dddb58423d11d2df61d749c7eaa1833596a964d9c0b651c2dbfa11a2c166af4c

Download Submit
C:\Windows\SysWOW64\pfbaseawafupc.exe

Filesize
255KB

MD5
37fefd266a07c6d1e0c17965d36f5541

SHA1
b0e6d4d5680de1aeef08dbe64dbff0b3cd8964b2

SHA256
7972740891bdb887e92c2b517aa228c84eeda2398efea985d683ee1e91ad0d08

SHA512
a5ea7cea282d19e4926a0a10c9d229a0c92c8366db9739a0a2e1d605609e1d71dd0e5b3f26918f825948ff07b76766954a35793909c1dd1da37f1ebad1b8f7cc

Download Submit
C:\Windows\SysWOW64\pfbaseawafupc.exe

Filesize
255KB

MD5
37fefd266a07c6d1e0c17965d36f5541

SHA1
b0e6d4d5680de1aeef08dbe64dbff0b3cd8964b2

SHA256
7972740891bdb887e92c2b517aa228c84eeda2398efea985d683ee1e91ad0d08

SHA512
a5ea7cea282d19e4926a0a10c9d229a0c92c8366db9739a0a2e1d605609e1d71dd0e5b3f26918f825948ff07b76766954a35793909c1dd1da37f1ebad1b8f7cc

Download Submit
C:\Windows\SysWOW64\pfbaseawafupc.exe

Filesize
255KB

MD5
37fefd266a07c6d1e0c17965d36f5541

SHA1
b0e6d4d5680de1aeef08dbe64dbff0b3cd8964b2

SHA256
7972740891bdb887e92c2b517aa228c84eeda2398efea985d683ee1e91ad0d08

SHA512
a5ea7cea282d19e4926a0a10c9d229a0c92c8366db9739a0a2e1d605609e1d71dd0e5b3f26918f825948ff07b76766954a35793909c1dd1da37f1ebad1b8f7cc

Download Submit
C:\Windows\SysWOW64\uwttoztd.exe

Filesize
255KB

MD5
3447906401dba3c9231c24c7c91935d8

SHA1
969f5821ecd3288757cdbe85e0cc7a13b6855c86

SHA256
e927140b727c3d470c262af243d5c27e856de4e0bfbf0b07ac744ed859e3f276

SHA512
da77ffd67314fbb9f5de3708c367dba770fd12824030e7b29cd4e8be065b048978c894a65e48b3b1e95dd8174f1f5af6469dc6fd386510e488ebd10ad51e1845

Download Submit
C:\Windows\SysWOW64\uwttoztd.exe

Filesize
255KB

MD5
3447906401dba3c9231c24c7c91935d8

SHA1
969f5821ecd3288757cdbe85e0cc7a13b6855c86

SHA256
e927140b727c3d470c262af243d5c27e856de4e0bfbf0b07ac744ed859e3f276

SHA512
da77ffd67314fbb9f5de3708c367dba770fd12824030e7b29cd4e8be065b048978c894a65e48b3b1e95dd8174f1f5af6469dc6fd386510e488ebd10ad51e1845

Download Submit
C:\Windows\SysWOW64\uwttoztd.exe

Filesize
255KB

MD5
3447906401dba3c9231c24c7c91935d8

SHA1
969f5821ecd3288757cdbe85e0cc7a13b6855c86

SHA256
e927140b727c3d470c262af243d5c27e856de4e0bfbf0b07ac744ed859e3f276

SHA512
da77ffd67314fbb9f5de3708c367dba770fd12824030e7b29cd4e8be065b048978c894a65e48b3b1e95dd8174f1f5af6469dc6fd386510e488ebd10ad51e1845

Download Submit
C:\Windows\mydoc.rtf

Filesize
223B

MD5
06604e5941c126e2e7be02c5cd9f62ec

SHA1
4eb9fdf8ff4e1e539236002bd363b82c8f8930e1

SHA256
85f2405d1f67021a3206faa26f6887932fea71aea070df3efb2902902e2d03e2

SHA512
803f5f2fddbf29fef34de184eb35c2311b7a694740983ca10b54ef252dd26cda4987458d2569f441c6dedc3478bea12b45bfd3566f1b256504a0869ad3829df7

Download Submit
\Windows\SysWOW64\hozzilahdr.exe

Filesize
255KB

MD5
8fb46797f1db7eb2e603225c64d4d8ea

SHA1
769380e59b517f0722e98994f6934c43519993d9

SHA256
ead1ae1cf747cfd2a115a1953ac403585803fb7204d0ffbaccb1cb4f493279c2

SHA512
ba9c9a1a75b541a02cd85a246b818682cf6f0ae90391565fef2b67666aa6ae752e2b0342b138576834204ebbf491e6a244fdd8e56453314dea67f2fcaccda791

Download Submit
\Windows\SysWOW64\neeohenwkniefsg.exe

Filesize
255KB

MD5
1e2f446a88bfdfc5885a1aa52589f6b3

SHA1
7e3d1836d454a6aa3994a6407f5263fb79fb2e50

SHA256
c8abc7e39504d3e734f101967582c188b5ffa28518b4a3d5a0a4f9c44425b670

SHA512
2c61eb968acbfb6b9ad8207cdcbe125eb6806c4cf23f037a6f18f5a5b4347560dddb58423d11d2df61d749c7eaa1833596a964d9c0b651c2dbfa11a2c166af4c

Download Submit
\Windows\SysWOW64\pfbaseawafupc.exe

Filesize
255KB

MD5
37fefd266a07c6d1e0c17965d36f5541

SHA1
b0e6d4d5680de1aeef08dbe64dbff0b3cd8964b2

SHA256
7972740891bdb887e92c2b517aa228c84eeda2398efea985d683ee1e91ad0d08

SHA512
a5ea7cea282d19e4926a0a10c9d229a0c92c8366db9739a0a2e1d605609e1d71dd0e5b3f26918f825948ff07b76766954a35793909c1dd1da37f1ebad1b8f7cc

Download Submit
\Windows\SysWOW64\pfbaseawafupc.exe

Filesize
255KB

MD5
37fefd266a07c6d1e0c17965d36f5541

SHA1
b0e6d4d5680de1aeef08dbe64dbff0b3cd8964b2

SHA256
7972740891bdb887e92c2b517aa228c84eeda2398efea985d683ee1e91ad0d08

SHA512
a5ea7cea282d19e4926a0a10c9d229a0c92c8366db9739a0a2e1d605609e1d71dd0e5b3f26918f825948ff07b76766954a35793909c1dd1da37f1ebad1b8f7cc

Download Submit
\Windows\SysWOW64\uwttoztd.exe

Filesize
255KB

MD5
3447906401dba3c9231c24c7c91935d8

SHA1
969f5821ecd3288757cdbe85e0cc7a13b6855c86

SHA256
e927140b727c3d470c262af243d5c27e856de4e0bfbf0b07ac744ed859e3f276

SHA512
da77ffd67314fbb9f5de3708c367dba770fd12824030e7b29cd4e8be065b048978c894a65e48b3b1e95dd8174f1f5af6469dc6fd386510e488ebd10ad51e1845

Download Submit
\Windows\SysWOW64\uwttoztd.exe

Filesize
255KB

MD5
3447906401dba3c9231c24c7c91935d8

SHA1
969f5821ecd3288757cdbe85e0cc7a13b6855c86

SHA256
e927140b727c3d470c262af243d5c27e856de4e0bfbf0b07ac744ed859e3f276

SHA512
da77ffd67314fbb9f5de3708c367dba770fd12824030e7b29cd4e8be065b048978c894a65e48b3b1e95dd8174f1f5af6469dc6fd386510e488ebd10ad51e1845

Download Submit
memory/544-56-0x0000000000000000-mapping.dmp

Download
memory/544-67-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/544-108-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/700-60-0x0000000000000000-mapping.dmp

Download
memory/700-94-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/700-109-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/744-78-0x0000000000000000-mapping.dmp

Download
memory/760-96-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/760-111-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/760-74-0x0000000000000000-mapping.dmp

Download
memory/812-115-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/812-110-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/812-66-0x0000000000000000-mapping.dmp

Download
memory/812-95-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/824-92-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/824-62-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/824-65-0x0000000002F30000-0x0000000002FD0000-memory.dmp

Filesize
640KB

Download
memory/824-69-0x0000000002F30000-0x0000000002FD0000-memory.dmp

Filesize
640KB

Download
memory/824-54-0x00000000757A1000-0x00000000757A3000-memory.dmp

Filesize
8KB

Download
memory/980-104-0x0000000070E1D000-0x0000000070E28000-memory.dmp

Filesize
44KB

Download
memory/980-100-0x000000005FFF0000-0x0000000060000000-memory.dmp

Filesize
64KB

Download
memory/980-99-0x000000006FE31000-0x000000006FE33000-memory.dmp

Filesize
8KB

Download
memory/980-91-0x0000000000000000-mapping.dmp

Download
memory/980-114-0x0000000070E1D000-0x0000000070E28000-memory.dmp

Filesize
44KB

Download
memory/980-93-0x00000000723B1000-0x00000000723B4000-memory.dmp

Filesize
12KB

Download
memory/1376-112-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1376-82-0x0000000000000000-mapping.dmp

Download
memory/1376-97-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1588-80-0x000007FEFB881000-0x000007FEFB883000-memory.dmp

Filesize
8KB

Download
memory/1736-113-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1736-98-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1736-116-0x0000000000400000-0x00000000004A0000-memory.dmp

Filesize
640KB

Download
memory/1736-86-0x0000000000000000-mapping.dmp

Download