Analysis

  • max time kernel
    99s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    30-09-2022 21:47

General

  • Target

    b8a9f9c01d7ee026baeabb968916e15a04c6eb4f214becff5eb73bf49acd9f36.exe

  • Size

    5MB

  • MD5

    559b9c9948db8d9243c9444dec15a2d6

  • SHA1

    cc5677af51082675d7fcac2bb017e8770b905771

  • SHA256

    b8a9f9c01d7ee026baeabb968916e15a04c6eb4f214becff5eb73bf49acd9f36

  • SHA512

    8ec671a6b2409c597a6f8500f8e1c8642b86ca6a60ddbcfb149102b08317590c5d6ffd998e09e86356c89a289cddba1209b05393f9fd8fb08358af3aa88faa17

  • SSDEEP

    98304:z8qHMzI8MbVuLnEZuORofgT5WZZy+YZLKtTM0LxjTuyHi4WZv+2:z8qszGVubmTWeYdL5vCJ

Malware Config

Extracted

Family

privateloader

C2

http://163.123.143.4/proxies.txt

http://107.182.129.251/server.txt

pastebin.com/raw/A7dSG1te

http://wfsdragon.ru/api/setStats.php

163.123.143.12

http://91.241.19.125/pub.php?pub=one

http://sarfoods.com/index.php

Attributes
payload_url
https://vipsofts.xyz/files/mega.bmp

Extracted

Family

djvu

C2

http://winnlinne.com/test3/get.php

http://winnlinne.com/lancer/get.php

Attributes
extension
.ofoq
offline_id
xkNzhkB1wvgoDI7Uo0HPNLY3qCuwoFpP7nlhlut1
payload_url
http://rgyui.top/dl/build2.exe
http://winnlinne.com/files/1/build3.exe
ransomnote
ATTENTION! Don't worry, you can return all your files! All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key. The only method of recovering files is to purchase decrypt tool and unique key for you. This software will decrypt all your encrypted files. What guarantees you have? You can send one of your encrypted file from your PC and we decrypt it for free. But we can decrypt only 1 file for free. File must not contain valuable information. You can get and look video overview decrypt tool: https://we.tl/t-EWKSsSJiVn Price of private key and decrypt software is $980. Discount 50% available if you contact us first 72 hours, that's price for you is $490. Please note that you'll never restore your data without payment. Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours. To get this software you need write on our e-mail: support@bestyourmail.ch Reserve e-mail address to contact us: datarestorehelp@airmail.cc Your personal ID: 0568Jhyjd
rsa_pubkey.plain

Extracted

Family

nymaim

C2

208.67.104.97

85.31.46.167

Extracted

Family

redline

Botnet

nam6.5

C2

103.89.90.61:34589

Attributes
auth_value
ea8cbb51ed8a91dcbe95697e8bb9a9d7

Extracted

Family

redline

Botnet

ruzki19

C2

176.113.115.146:9582

Attributes
auth_value
c97cb30de806db62d9a577d3d800e1a4

Extracted

Family

vidar

Version

54.7

Botnet

517

C2

https://t.me/trampapanam

https://nerdculture.de/@yoxhyp

Attributes
profile_id
517

Signatures

  • Detected Djvu ransomware ⋅ 12 IoCs
  • Detects Smokeloader packer ⋅ 1 IoCs
  • Djvu Ransomware

    Ransomware which is a variant of the STOP family.

  • Modifies Windows Defender Real-time Protection settings ⋅ 3 TTPs 7 IoCs
  • NyMaim

    NyMaim is a malware with various capabilities written in C++ and first seen in 2013.

  • PrivateLoader

    PrivateLoader is a downloader sold as a pay-per-install malware distribution service.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload ⋅ 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) ⋅ 2 TTPs 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 20 IoCs
  • VMProtect packed file ⋅ 12 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks BIOS information in registry ⋅ 2 TTPs 3 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings ⋅ 2 TTPs 6 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL ⋅ 2 IoCs
  • Modifies file permissions ⋅ 1 TTPs 1 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer ⋅ 9 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
  • Adds Run key to start application ⋅ 2 TTPs 3 IoCs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled ⋅ 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs
  • Looks up external IP address via web service ⋅ 13 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory ⋅ 5 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger ⋅ 1 IoCs
  • Suspicious use of SetThreadContext ⋅ 4 IoCs
  • Drops file in Program Files directory ⋅ 2 IoCs
  • Enumerates physical storage devices ⋅ 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash ⋅ 16 IoCs
  • Checks SCSI registry key(s) ⋅ 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) ⋅ 1 TTPs 7 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe ⋅ 1 IoCs
  • Enumerates system info in registry ⋅ 2 TTPs 2 IoCs
  • Kills process with taskkill ⋅ 1 IoCs
  • Modifies registry class ⋅ 2 IoCs
  • Modifies system certificate store ⋅ 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 64 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b8a9f9c01d7ee026baeabb968916e15a04c6eb4f214becff5eb73bf49acd9f36.exe
    "C:\Users\Admin\AppData\Local\Temp\b8a9f9c01d7ee026baeabb968916e15a04c6eb4f214becff5eb73bf49acd9f36.exe"
    Identifies VirtualBox via ACPI registry values (likely anti-VM)
    Checks BIOS information in registry
    Checks computer location settings
    Checks whether UAC is enabled
    Drops file in System32 directory
    Suspicious use of NtSetInformationThreadHideFromDebugger
    Modifies registry class
    Modifies system certificate store
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of WriteProcessMemory
    PID:2136
    • C:\Users\Admin\Pictures\Minor Policy\jGtZ9NqV1iA1L3i8PK_rRowh.exe
      "C:\Users\Admin\Pictures\Minor Policy\jGtZ9NqV1iA1L3i8PK_rRowh.exe"
      Executes dropped EXE
      PID:1816
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
        Creates scheduled task(s)
        PID:4040
      • C:\Windows\SysWOW64\schtasks.exe
        schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
        Creates scheduled task(s)
        PID:2396
      • C:\Users\Admin\Documents\9lMk1jGixcYWXdKoD7Ks9cxx.exe
        "C:\Users\Admin\Documents\9lMk1jGixcYWXdKoD7Ks9cxx.exe"
        Modifies Windows Defender Real-time Protection settings
        Executes dropped EXE
        Checks computer location settings
        Suspicious behavior: EnumeratesProcesses
        PID:3004
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 2208
          Program crash
          PID:83500
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 2256
          Program crash
          PID:83524
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 2248
          Program crash
          PID:83540
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3004 -s 2340
          Program crash
          PID:83756
    • C:\Users\Admin\Pictures\Minor Policy\D5l03Sylj3t5AJLTuQ_okNwK.exe
      "C:\Users\Admin\Pictures\Minor Policy\D5l03Sylj3t5AJLTuQ_okNwK.exe"
      Executes dropped EXE
      Checks computer location settings
      PID:2100
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 456
        Program crash
        PID:5040
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 768
        Program crash
        PID:1620
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 776
        Executes dropped EXE
        Program crash
        PID:2188
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 792
        Program crash
        PID:25696
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 800
        Program crash
        PID:43216
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 984
        Program crash
        PID:56228
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 1012
        Program crash
        PID:66332
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 1264
        Program crash
        PID:83864
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /c start /I "" "C:\Users\Admin\AppData\Local\Temp\j8ZnNr3GYMuPTn\Cleaner.exe"
        PID:97608
        • C:\Users\Admin\AppData\Local\Temp\j8ZnNr3GYMuPTn\Cleaner.exe
          "C:\Users\Admin\AppData\Local\Temp\j8ZnNr3GYMuPTn\Cleaner.exe"
          Executes dropped EXE
          PID:101364
          • C:\Windows\system32\WerFault.exe
            C:\Windows\system32\WerFault.exe -u -p 101364 -s 2208
            Program crash
            PID:2328
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 2100 -s 1412
        Program crash
        PID:5356
    • C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe
      "C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious use of WriteProcessMemory
      PID:1768
      • C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe
        "C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe"
        Executes dropped EXE
        Checks computer location settings
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        PID:4668
        • C:\Windows\SysWOW64\icacls.exe
          icacls "C:\Users\Admin\AppData\Local\331cada4-b533-4daf-8a8f-e3e12b61ee2a" /deny *S-1-1-0:(OI)(CI)(DE,DC)
          Modifies file permissions
          PID:3848
        • C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe
          "C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe" --Admin IsNotAutoStart IsNotTask
          Executes dropped EXE
          Suspicious use of SetThreadContext
          PID:101288
          • C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe
            "C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe" --Admin IsNotAutoStart IsNotTask
            Executes dropped EXE
            PID:4932
            • C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build2.exe
              "C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build2.exe"
              PID:1220
              • C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build2.exe
                "C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build2.exe"
                PID:4360
                • C:\Windows\SysWOW64\cmd.exe
                  "C:\Windows\System32\cmd.exe" S/c taskkill /im build2.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build2.exe" & del C:\PrograData\*.dll & exit
                  PID:5192
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /im build2.exe /f
                    Kills process with taskkill
                    PID:5244
                  • C:\Windows\SysWOW64\timeout.exe
                    timeout /t 6
                    Delays execution with timeout.exe
                    PID:5308
            • C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build3.exe
              "C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build3.exe"
              PID:2288
              • C:\Windows\SysWOW64\schtasks.exe
                /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
                Executes dropped EXE
                Suspicious use of SetThreadContext
                Creates scheduled task(s)
                Suspicious use of WriteProcessMemory
                PID:116
    • C:\Users\Admin\Pictures\Minor Policy\XIZUb6ao6p5geRweUaDKirvB.exe
      "C:\Users\Admin\Pictures\Minor Policy\XIZUb6ao6p5geRweUaDKirvB.exe"
      Executes dropped EXE
      Checks computer location settings
      Modifies registry class
      Suspicious use of WriteProcessMemory
      PID:5024
      • C:\Windows\SysWOW64\control.exe
        "C:\Windows\System32\control.exe" "C:\Users\Admin\AppData\Local\Temp\YRoB.cPL",
        Suspicious use of WriteProcessMemory
        PID:1856
        • C:\Windows\SysWOW64\rundll32.exe
          "C:\Windows\system32\rundll32.exe" Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\YRoB.cPL",
          Loads dropped DLL
          PID:4020
          • C:\Windows\system32\RunDll32.exe
            C:\Windows\system32\RunDll32.exe Shell32.dll,Control_RunDLL "C:\Users\Admin\AppData\Local\Temp\YRoB.cPL",
            PID:83412
            • C:\Windows\SysWOW64\rundll32.exe
              "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\shell32.dll",#44 "C:\Users\Admin\AppData\Local\Temp\YRoB.cPL",
              Loads dropped DLL
              PID:97588
    • C:\Users\Admin\Pictures\Minor Policy\3FFedelFaF2oZIP5tPJyG94J.exe
      "C:\Users\Admin\Pictures\Minor Policy\3FFedelFaF2oZIP5tPJyG94J.exe"
      Executes dropped EXE
      Checks SCSI registry key(s)
      Suspicious behavior: EnumeratesProcesses
      Suspicious behavior: MapViewOfSection
      PID:3512
    • C:\Users\Admin\Pictures\Minor Policy\ctZCmjZhUkpEZqskprYgt7tS.exe
      "C:\Users\Admin\Pictures\Minor Policy\ctZCmjZhUkpEZqskprYgt7tS.exe"
      Executes dropped EXE
      PID:2996
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 2996 -s 424
        Program crash
        PID:4536
    • C:\Users\Admin\Pictures\Minor Policy\inJe137YJYd59jtqoLTnkfLI.exe
      "C:\Users\Admin\Pictures\Minor Policy\inJe137YJYd59jtqoLTnkfLI.exe"
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:4344
      • C:\Users\Admin\AppData\Local\Temp\7zS5BDB.tmp\Install.exe
        .\Install.exe
        Executes dropped EXE
        Suspicious use of WriteProcessMemory
        PID:728
        • C:\Users\Admin\AppData\Local\Temp\7zS8B58.tmp\Install.exe
          .\Install.exe /S /site_id "525403"
          Executes dropped EXE
          Checks BIOS information in registry
          Checks computer location settings
          Drops file in System32 directory
          Enumerates system info in registry
          PID:4688
          • C:\Windows\SysWOW64\forfiles.exe
            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions\" /f /v \"exe\" /t REG_SZ /d 0 /reg:64&"
            PID:2272
            • C:\Windows\SysWOW64\cmd.exe
              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64&
              PID:2300
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:32
                PID:4080
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Extensions" /f /v "exe" /t REG_SZ /d 0 /reg:64
                PID:25728
          • C:\Windows\SysWOW64\forfiles.exe
            "C:\Windows\System32\forfiles.exe" /p c:\windows\system32 /m cmd.exe /c "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:32&REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet\" /f /v \"SpyNetReporting\" /t REG_DWORD /d 0 /reg:64&"
            PID:1632
            • C:\Windows\SysWOW64\cmd.exe
              /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32&REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64&
              PID:4828
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:32
                PID:4536
              • \??\c:\windows\SysWOW64\reg.exe
                REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Spynet" /f /v "SpyNetReporting" /t REG_DWORD /d 0 /reg:64
                PID:25664
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /CREATE /TN "gNQTYWcCe" /SC once /ST 11:59:03 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
            Creates scheduled task(s)
            PID:56116
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /run /I /tn "gNQTYWcCe"
            PID:59404
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /DELETE /F /TN "gNQTYWcCe"
            PID:4508
          • C:\Windows\SysWOW64\schtasks.exe
            schtasks /CREATE /TN "bGZpGlqvDNKjraWjlZ" /SC once /ST 17:56:00 /RU "SYSTEM" /TR "\"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\nXcKZYb.exe\" d8 /site_id 525403 /S" /V1 /F
            Creates scheduled task(s)
            PID:3460
    • C:\Users\Admin\Pictures\Minor Policy\tnBi_LPXrPOdRfvXJLGNWbux.exe
      "C:\Users\Admin\Pictures\Minor Policy\tnBi_LPXrPOdRfvXJLGNWbux.exe"
      PID:2188
    • C:\Users\Admin\Pictures\Minor Policy\g_0T36pkSKuD0wNNUoJPNFmc.exe
      "C:\Users\Admin\Pictures\Minor Policy\g_0T36pkSKuD0wNNUoJPNFmc.exe"
      Executes dropped EXE
      Suspicious use of SetThreadContext
      PID:3364
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
        PID:101204
    • C:\Users\Admin\Pictures\Minor Policy\1J3MoV58JJNrc5Q44YQxEq8u.exe
      "C:\Users\Admin\Pictures\Minor Policy\1J3MoV58JJNrc5Q44YQxEq8u.exe"
      PID:116
      • C:\Users\Admin\Pictures\Minor Policy\1J3MoV58JJNrc5Q44YQxEq8u.exe
        "C:\Users\Admin\Pictures\Minor Policy\1J3MoV58JJNrc5Q44YQxEq8u.exe"
        Executes dropped EXE
        PID:1152
    • C:\Users\Admin\Pictures\Minor Policy\dCqdhdbh8BTkkk5ss0LFdsuX.exe
      "C:\Users\Admin\Pictures\Minor Policy\dCqdhdbh8BTkkk5ss0LFdsuX.exe"
      Executes dropped EXE
      Adds Run key to start application
      Suspicious use of WriteProcessMemory
      PID:4004
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
        Executes dropped EXE
        Suspicious use of AdjustPrivilegeToken
        PID:4952
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 4952 -s 2032
          Program crash
          PID:4064
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -s WPDBusEnum
    PID:1192
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s fhsvc
    PID:1012
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 444 -p 2996 -ip 2996
    PID:3644
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2100 -ip 2100
    PID:4024
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2100 -ip 2100
    PID:4552
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 4952 -ip 4952
    PID:4800
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 480 -p 2100 -ip 2100
    PID:4072
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 2100 -ip 2100
    PID:308
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 488 -p 2100 -ip 2100
    PID:43176
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 184 -p 2100 -ip 2100
    PID:56180
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 2100 -ip 2100
    PID:59436
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
    PID:66456
    • C:\Windows\system32\gpupdate.exe
      "C:\Windows\system32\gpupdate.exe" /force
      PID:3572
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 564 -p 3004 -ip 3004
    PID:83420
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 3004 -ip 3004
    PID:83444
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3004 -ip 3004
    PID:83432
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3004 -ip 3004
    PID:83688
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2100 -ip 2100
    PID:83836
  • C:\Windows\system32\WerFault.exe
    C:\Windows\system32\WerFault.exe -pss -s 548 -p 101364 -ip 101364
    PID:3900
  • C:\Windows\system32\gpscript.exe
    gpscript.exe /RefreshSystemParam
    PID:4040
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 560 -p 2100 -ip 2100
    PID:5284
  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    PID:5276
    • C:\Windows\SysWOW64\schtasks.exe
      /C /create /F /sc minute /mo 1 /tn "Azure-Update-Task" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe"
      Creates scheduled task(s)
      PID:5328
  • C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\nXcKZYb.exe
    C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\nXcKZYb.exe d8 /site_id 525403 /S
    PID:5372
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"225451\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"256596\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"242872\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749373\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147807942\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735735\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737010\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737007\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147735503\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147749376\" /t REG_SZ /d 6 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction\" /f /v \"2147737394\" /t REG_SZ /d 6 /reg:64;"
      PID:5460
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
        PID:5588
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:32
          PID:5620
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 225451 /t REG_SZ /d 6 /reg:64
        PID:5676
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:32
        PID:5696
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 256596 /t REG_SZ /d 6 /reg:64
        PID:5712
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:32
        PID:5732
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 242872 /t REG_SZ /d 6 /reg:64
        PID:5800
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:32
        PID:5844
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749373 /t REG_SZ /d 6 /reg:64
        PID:5968
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:32
        PID:6052
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147807942 /t REG_SZ /d 6 /reg:64
        PID:6120
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:32
        PID:6180
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:32
        PID:6204
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735735 /t REG_SZ /d 6 /reg:64
        PID:6192
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737010 /t REG_SZ /d 6 /reg:64
        PID:6216
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:32
        PID:6268
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737007 /t REG_SZ /d 6 /reg:64
        PID:6296
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:32
        PID:6316
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737503 /t REG_SZ /d 6 /reg:64
        PID:6348
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:32
        PID:6360
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:32
        PID:6388
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147735503 /t REG_SZ /d 6 /reg:64
        PID:6376
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147749376 /t REG_SZ /d 6 /reg:64
        PID:6400
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:32
        PID:6452
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Threats\ThreatIDDefaultAction" /f /v 2147737394 /t REG_SZ /d 6 /reg:64
        PID:6488
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell "cmd /C REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCMDmHxGrLJHC\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\LCMDmHxGrLJHC\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\VnSvEXTIbraTatzTOsR\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jIUrjTqJU\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\jIUrjTqJU\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nVCmSimpmwUn\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\nVCmSimpmwUn\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\twylNxKJekDU2\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Program Files (x86)\twylNxKJekDU2\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CEEEIGvNcEpIBnVB\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\ProgramData\CEEEIGvNcEpIBnVB\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\" /t REG_DWORD /d 0 /reg:64;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fwhiGQHhSfnZUzkc\" /t REG_DWORD /d 0 /reg:32;REG ADD \"HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths\" /f /v \"C:\Windows\Temp\fwhiGQHhSfnZUzkc\" /t REG_DWORD /d 0 /reg:64;"
      PID:6536
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe" /C REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:32
        PID:6668
        • C:\Windows\SysWOW64\reg.exe
          REG ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:32
          PID:6684
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\LCMDmHxGrLJHC" /t REG_DWORD /d 0 /reg:64
        PID:6700
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:32
        PID:6712
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\VnSvEXTIbraTatzTOsR" /t REG_DWORD /d 0 /reg:64
        PID:6724
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:32
        PID:6736
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\jIUrjTqJU" /t REG_DWORD /d 0 /reg:64
        PID:6748
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:32
        PID:6764
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\nVCmSimpmwUn" /t REG_DWORD /d 0 /reg:64
        PID:6780
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:32
        PID:6796
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v "C:\Program Files (x86)\twylNxKJekDU2" /t REG_DWORD /d 0 /reg:64
        PID:6812
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CEEEIGvNcEpIBnVB /t REG_DWORD /d 0 /reg:32
        PID:6824
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\ProgramData\CEEEIGvNcEpIBnVB /t REG_DWORD /d 0 /reg:64
        PID:6836
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh /t REG_DWORD /d 0 /reg:32
        PID:6852
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh /t REG_DWORD /d 0 /reg:64
        PID:6864
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fwhiGQHhSfnZUzkc /t REG_DWORD /d 0 /reg:32
        PID:6880
      • C:\Windows\SysWOW64\reg.exe
        "C:\Windows\system32\reg.exe" ADD "HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\Exclusions\Paths" /f /v C:\Windows\Temp\fwhiGQHhSfnZUzkc /t REG_DWORD /d 0 /reg:64
        PID:6892
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /CREATE /TN "gOwCxPkOd" /SC once /ST 05:21:05 /F /RU "Admin" /TR "powershell -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA=="
      Creates scheduled task(s)
      PID:6912
    • C:\Windows\SysWOW64\schtasks.exe
      schtasks /run /I /tn "gOwCxPkOd"
      PID:6952
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\7932.dll
    PID:5600
    • C:\Windows\SysWOW64\regsvr32.exe
      /s C:\Users\Admin\AppData\Local\Temp\7932.dll
      PID:5652
  • C:\Users\Admin\AppData\Local\Temp\7B56.exe
    C:\Users\Admin\AppData\Local\Temp\7B56.exe
    PID:5744
  • C:\Users\Admin\AppData\Local\Temp\7D5B.exe
    C:\Users\Admin\AppData\Local\Temp\7D5B.exe
    PID:5768
    • C:\Users\Admin\AppData\Local\Temp\7D5B.exe
      C:\Users\Admin\AppData\Local\Temp\7D5B.exe
      PID:6416
      • C:\Users\Admin\AppData\Local\Temp\7D5B.exe
        "C:\Users\Admin\AppData\Local\Temp\7D5B.exe" --Admin IsNotAutoStart IsNotTask
        PID:6628
  • C:\Users\Admin\AppData\Local\Temp\820F.exe
    C:\Users\Admin\AppData\Local\Temp\820F.exe
    PID:5788
    • C:\Windows\SysWOW64\Wbem\wmic.exe
      wmic os get Caption
      PID:5896
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic path win32_VideoController get name"
      PID:6076
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic path win32_VideoController get name
        PID:6136
    • C:\Windows\SysWOW64\cmd.exe
      cmd /C "wmic cpu get name"
      PID:6232
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic cpu get name
        PID:6288
  • C:\Users\Admin\AppData\Local\Temp\9039.exe
    C:\Users\Admin\AppData\Local\Temp\9039.exe
    PID:5876
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:5888
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    PID:6004
  • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
    C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE -WindowStyle Hidden -EncodedCommand cwB0AGEAcgB0AC0AcAByAG8AYwBlAHMAcwAgAC0AVwBpAG4AZABvAHcAUwB0AHkAbABlACAASABpAGQAZABlAG4AIABnAHAAdQBwAGQAYQB0AGUALgBlAHgAZQAgAC8AZgBvAHIAYwBlAA==
    PID:6992

Network

MITRE ATT&CK Matrix

Replay Monitor

00:00 00:00

Downloads

  • C:\ProgramData\mozglue.dll
    MD5

    c8fd9be83bc728cc04beffafc2907fe9

    SHA1

    95ab9f701e0024cedfbd312bcfe4e726744c4f2e

    SHA256

    ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

    SHA512

    fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

  • C:\ProgramData\nss3.dll
    MD5

    1cc453cdf74f31e4d913ff9c10acdde2

    SHA1

    6e85eae544d6e965f15fa5c39700fa7202f3aafe

    SHA256

    ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

    SHA512

    dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    MD5

    5f0a548198075b4cd8c891c5c0f45e4c

    SHA1

    c3dd48a91f5a4dfbecd2a9e5802a8e5d8623aab6

    SHA256

    bcb8d4f0e605ffe557f9f3d23291e2212f39acfa1df9f24331a4075810555839

    SHA512

    8ade693197f9ca350f7c549312de77d70ef362dd3772a9ebb86c30dc7311d047bac0b9e1b517001b4e470271f7f181313f87eeae5b7a71ec5b7be5380525e22f

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    MD5

    cb19ea31ccbd0203dd87e096916c57fa

    SHA1

    cab9da6765c414006fc24a26afe3d9faed3da46c

    SHA256

    f2c2e4c4cb0138ea54016a5b4e248a37f10c3ce22ad3ac85f8509a9692d0394b

    SHA512

    20b5e6d75aa6340e47bb723541ede1ca9a54b8df916e3b9ae6e27ae869dfd13605feb400e0c847974594e126b9852dcb1785f55fc93ba10abcdef93ef71f5b36

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D
    MD5

    2eaeedd74649d674600a5e2eeb7ef49f

    SHA1

    92dbb57eb20a2bcf3b2be2a02a39d2f6bd924bcb

    SHA256

    54c1cf79060c950411319505d349f1108903b63a64a990775925e66ab84e1856

    SHA512

    c3eb5689be67fb4a5c1f120f895ce6ada8e68e3b2f7716ebe06cd7367bfeb26125692552b00584112eb217b52cc11218a58ed6a5c944d77a221c8de6a435725e

  • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
    MD5

    5488bc3420458dd96abda5cdf03f4bc3

    SHA1

    14f640819eb6c664562f373b68d320e9f6895f8a

    SHA256

    780ac766377ea7189ff45eb82de360d74e3c8bbd16e9cdd9e8da3be4e2d60c88

    SHA512

    9475b94ad2bebb3f58c3057e1b9d6f75eac11f4f1dd75e79710ddbbb3ad64315c36df152620f6dcfbda5d80cf7472d09f5c822aea0bdf68cb3c1142a43304632

  • C:\Users\Admin\AppData\Local\331cada4-b533-4daf-8a8f-e3e12b61ee2a\_wFZw_b_7NBBzMUe66oQSHYT.exe
    MD5

    35dd45dad308b8dde351ebac5abb29bb

    SHA1

    a4d86c925fd6ac1a5e5304f1b79b153e496c7191

    SHA256

    e7888cabe70d515331ffdc4f34d298f5bcdd3cbd267baf4388949e836ec490f7

    SHA512

    db070bfaf5d1f626a47e7d992e0f07296773d265b7063825ecd251dc90a9297c1c1e523da29b15ea2f71b6be44322fd5c943d11dada671a9f69fcdc3ac1bf367

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\1J3MoV58JJNrc5Q44YQxEq8u.exe.log
    MD5

    03febbff58da1d3318c31657d89c8542

    SHA1

    c9e017bd9d0a4fe533795b227c855935d86c2092

    SHA256

    5164770a37b199a79ccd23b399bb3309228973d9f74c589bc2623dc613b37ac4

    SHA512

    3750c372bbca1892e9c1b34681d592c693e725a8b149c3d6938079cd467628cec42c4293b0d886b57a786abf45f5e7229247b3445001774e3e793ff5a3accfa3

  • C:\Users\Admin\AppData\Local\Temp\7932.dll
    MD5

    67fdb82fdbc2b7c96197e1e7910221d5

    SHA1

    a04e893b5e681ec1dd4b4518704b1e8f4e3ea2d4

    SHA256

    8a914b14659e7c2346089fa7a6f43755d94cf89fd56de4c1a7f6aa60ab451a2e

    SHA512

    5ad03c8b6b9e242b84f85cc0a8637164d1a0aaa5dd1994a9f2d567de65beac2b19ba2533277eeb22c068122eb5fca45435799398fc0e3031384bffdeeb1078fc

  • C:\Users\Admin\AppData\Local\Temp\7932.dll
    MD5

    67fdb82fdbc2b7c96197e1e7910221d5

    SHA1

    a04e893b5e681ec1dd4b4518704b1e8f4e3ea2d4

    SHA256

    8a914b14659e7c2346089fa7a6f43755d94cf89fd56de4c1a7f6aa60ab451a2e

    SHA512

    5ad03c8b6b9e242b84f85cc0a8637164d1a0aaa5dd1994a9f2d567de65beac2b19ba2533277eeb22c068122eb5fca45435799398fc0e3031384bffdeeb1078fc

  • C:\Users\Admin\AppData\Local\Temp\7B56.exe
    MD5

    86345902abc8dc824054e4072baa1b64

    SHA1

    0b568cfd96818707561dc4fa9ccb58555bf6547a

    SHA256

    6014786b41622c5201cdb283d606c70831da00f1d890087b2be68fb4f5515e71

    SHA512

    1c3113717337af7e0d4382f07ffbb4905e5f8e42c0c598f6e071fdefd7ee28fd0b13f811697e32898b6b25cb78f76bd799a2eb3ed94d037050f1a7010a4db3c4

  • C:\Users\Admin\AppData\Local\Temp\7zS5BDB.tmp\Install.exe
    MD5

    0b786ca3e35c80e9245ff9078f0be060

    SHA1

    1937fec036f87e48a94631eb66b9b363c7389454

    SHA256

    e64eca254df4aa89688cad2809ab23d5279251a97aefe12803dc3c7d256a093d

    SHA512

    821594a73d9caaa7eb1396dd00f06919469a8074b91cd577304800afcb62ae8da8a54ffa394ebd451d0c5d27dcb54586a5421011b89c28318819151a980ea15a

  • C:\Users\Admin\AppData\Local\Temp\7zS5BDB.tmp\Install.exe
    MD5

    0b786ca3e35c80e9245ff9078f0be060

    SHA1

    1937fec036f87e48a94631eb66b9b363c7389454

    SHA256

    e64eca254df4aa89688cad2809ab23d5279251a97aefe12803dc3c7d256a093d

    SHA512

    821594a73d9caaa7eb1396dd00f06919469a8074b91cd577304800afcb62ae8da8a54ffa394ebd451d0c5d27dcb54586a5421011b89c28318819151a980ea15a

  • C:\Users\Admin\AppData\Local\Temp\7zS8B58.tmp\Install.exe
    MD5

    6f52a47480dae7c97a64dd5aebb8e426

    SHA1

    204fe492e1cdeacea89a4f3b2cf41626053bc992

    SHA256

    a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

    SHA512

    994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

  • C:\Users\Admin\AppData\Local\Temp\7zS8B58.tmp\Install.exe
    MD5

    6f52a47480dae7c97a64dd5aebb8e426

    SHA1

    204fe492e1cdeacea89a4f3b2cf41626053bc992

    SHA256

    a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

    SHA512

    994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    MD5

    23ad32c0b64c2f5897e3287b2a89ccec

    SHA1

    bb299faef68cb85afede2c9c63cd622911e6f9c6

    SHA256

    c38d083a7117903088e09fe34b5d51f33c64a966871e9f1f1029efb853f90c84

    SHA512

    6e93cf350a1d9808a8b2c98d38c6e79f7e44fbfdcc7b0f80ba64946dc1dc90774956d3355ea2ff182970d3ff0899aa8785179825de5ab6c8b14ac3d5b1891336

  • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
    MD5

    23ad32c0b64c2f5897e3287b2a89ccec

    SHA1

    bb299faef68cb85afede2c9c63cd622911e6f9c6

    SHA256

    c38d083a7117903088e09fe34b5d51f33c64a966871e9f1f1029efb853f90c84

    SHA512

    6e93cf350a1d9808a8b2c98d38c6e79f7e44fbfdcc7b0f80ba64946dc1dc90774956d3355ea2ff182970d3ff0899aa8785179825de5ab6c8b14ac3d5b1891336

  • C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\nXcKZYb.exe
    MD5

    6f52a47480dae7c97a64dd5aebb8e426

    SHA1

    204fe492e1cdeacea89a4f3b2cf41626053bc992

    SHA256

    a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

    SHA512

    994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

  • C:\Users\Admin\AppData\Local\Temp\LhLAIbjVjtdXSeCjh\NRKtMpzzQqeBbPa\nXcKZYb.exe
    MD5

    6f52a47480dae7c97a64dd5aebb8e426

    SHA1

    204fe492e1cdeacea89a4f3b2cf41626053bc992

    SHA256

    a506223f4ca78c5c90ca3e02d00a1fef0e74b7050712c2a5e7ebaa160fa6c879

    SHA512

    994468252493276e3f3ebde2f03153d16f862ce3277f234785116394f570bec1e9bd7e49e40321957b7289f6bdb85a06871bbb162a552285c0b812a54fe5d78c

  • C:\Users\Admin\AppData\Local\Temp\YRoB.cPL
    MD5

    f434ee410e569cd88428a9e3e62bb6ce

    SHA1

    f63f787de1670fa87934eb363221b7e9d2657245

    SHA256

    267292cc6a54ebe075108d722b4bc9bd861fa9b564f56393b608a2a4715a4f21

    SHA512

    ba0ebbd2b06b99a7cf63df8435dd8502b87e6715cd21b9f4fcacf3bc687df0a3a19c04729906d0867bcf771eb122d9bb0105ebd570f353a7822b6a0044a9b4a7

  • C:\Users\Admin\AppData\Local\Temp\j8ZnNr3GYMuPTn\Bunifu_UI_v1.5.3.dll
    MD5

    2ecb51ab00c5f340380ecf849291dbcf

    SHA1

    1a4dffbce2a4ce65495ed79eab42a4da3b660931

    SHA256

    f1b3e0f2750a9103e46a6a4a34f1cf9d17779725f98042cc2475ec66484801cf

    SHA512

    e241a48eafcaf99187035f0870d24d74ae97fe84aaadd2591cceea9f64b8223d77cfb17a038a58eadd3b822c5201a6f7494f26eea6f77d95f77f6c668d088e6b

  • C:\Users\Admin\AppData\Local\Temp\j8ZnNr3GYMuPTn\Cleaner.exe
    MD5

    a1a19faf0af29841daeeaad999d899bd

    SHA1

    f67b9afdab167d5bcc544358b0e7fd2858784508

    SHA256

    f349739486dcb45f7cd39440784224c66a5d2c4bd2a47c48606e2f481a0fabe7

    SHA512

    a66ec486262e797bafd4fa032a719e499217993479fa78938e43db13289fe6fefc0ef3c3359e3cacb6223134396852be7cc9122c46ae74db3e9842d7f4fe65a8

  • C:\Users\Admin\AppData\Local\Temp\j8ZnNr3GYMuPTn\Cleaner.exe
    MD5

    a1a19faf0af29841daeeaad999d899bd

    SHA1

    f67b9afdab167d5bcc544358b0e7fd2858784508

    SHA256

    f349739486dcb45f7cd39440784224c66a5d2c4bd2a47c48606e2f481a0fabe7

    SHA512

    a66ec486262e797bafd4fa032a719e499217993479fa78938e43db13289fe6fefc0ef3c3359e3cacb6223134396852be7cc9122c46ae74db3e9842d7f4fe65a8

  • C:\Users\Admin\AppData\Local\Temp\yRob.cpl
    MD5

    f434ee410e569cd88428a9e3e62bb6ce

    SHA1

    f63f787de1670fa87934eb363221b7e9d2657245

    SHA256

    267292cc6a54ebe075108d722b4bc9bd861fa9b564f56393b608a2a4715a4f21

    SHA512

    ba0ebbd2b06b99a7cf63df8435dd8502b87e6715cd21b9f4fcacf3bc687df0a3a19c04729906d0867bcf771eb122d9bb0105ebd570f353a7822b6a0044a9b4a7

  • C:\Users\Admin\AppData\Local\Temp\yRob.cpl
    MD5

    f434ee410e569cd88428a9e3e62bb6ce

    SHA1

    f63f787de1670fa87934eb363221b7e9d2657245

    SHA256

    267292cc6a54ebe075108d722b4bc9bd861fa9b564f56393b608a2a4715a4f21

    SHA512

    ba0ebbd2b06b99a7cf63df8435dd8502b87e6715cd21b9f4fcacf3bc687df0a3a19c04729906d0867bcf771eb122d9bb0105ebd570f353a7822b6a0044a9b4a7

  • C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build2.exe
    MD5

    bc47d3a0d4a74adc40b3a7035344becb

    SHA1

    dd80bbe70106b62ea58924173a364cc936a0b1f4

    SHA256

    06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

    SHA512

    4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

  • C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build2.exe
    MD5

    bc47d3a0d4a74adc40b3a7035344becb

    SHA1

    dd80bbe70106b62ea58924173a364cc936a0b1f4

    SHA256

    06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

    SHA512

    4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

  • C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build2.exe
    MD5

    bc47d3a0d4a74adc40b3a7035344becb

    SHA1

    dd80bbe70106b62ea58924173a364cc936a0b1f4

    SHA256

    06d1366df3628a010416384f7c77c493ac35f13ee05e010751708d681ebe5169

    SHA512

    4a4ef35c5fcbfc5a6b86dd6235f8b1b4f048ee5b5bd74fd9173a65cd450ec0f58fcf74f5fd2e58dd5dee486c0e41c2523cd6d7528d56fc2627fbdf8b598a29e4

  • C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build3.exe
    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Local\fbb536a1-f94f-4574-8978-b690d0841125\build3.exe
    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\AppData\Roaming\Microsoft\Network\mstsca.exe
    MD5

    9ead10c08e72ae41921191f8db39bc16

    SHA1

    abe3bce01cd34afc88e2c838173f8c2bd0090ae1

    SHA256

    8d7f0e6b6877bdfb9f4531afafd0451f7d17f0ac24e2f2427e9b4ecc5452b9f0

    SHA512

    aa35dbc59a3589df2763e76a495ce5a9e62196628b4c1d098add38bd7f27c49edf93a66fb8507fb746e37ee32932da2460e440f241abe1a5a279abcc1e5ffe4a

  • C:\Users\Admin\Desktop\Cleaner.lnk
    MD5

    9ea690c2f57b91b08946c9ee57da3230

    SHA1

    85b7021fecb0229512d0f018b700a9bdb48c4d25

    SHA256

    6a49fac1d519296d14a0b779313d76a34b3da566267f23dc876a0768f2d80bdf

    SHA512

    218d7fd53001e0efff3ccf192482cd27e4341a1ce157ba66124490e1b19987025ff6e15762537fbcfc9a84b73b31245eb6fa3a89bff39af30aa5b3019e530589

  • C:\Users\Admin\Documents\9lMk1jGixcYWXdKoD7Ks9cxx.exe
    MD5

    312ad3b67a1f3a75637ea9297df1cedb

    SHA1

    7d922b102a52241d28f1451d3542db12b0265b75

    SHA256

    3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e

    SHA512

    848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515

  • C:\Users\Admin\Documents\9lMk1jGixcYWXdKoD7Ks9cxx.exe
    MD5

    312ad3b67a1f3a75637ea9297df1cedb

    SHA1

    7d922b102a52241d28f1451d3542db12b0265b75

    SHA256

    3b4c1d0a112668872c1d4f9c9d76087a2afe7a8281a6cb6b972c95fb2f4eb28e

    SHA512

    848db7d47dc37a9025e3df0dda4fbf1c84d9a9191febae38621d9c9b09342a987ff0587108cccfd874cb900c88c5f9f9ca0548f3027f6515ed85c92fd26f8515

  • C:\Users\Admin\Pictures\Minor Policy\1J3MoV58JJNrc5Q44YQxEq8u.exe
    MD5

    086fe35804c1c397aa0c338f4ba5b485

    SHA1

    72fb0c1301676f43269dafdd9a0b878d7b6bad97

    SHA256

    de53e9a94cf357293dc9fe81b8ddb4d2e42208db9ef231e9a8ba15987ebc79d2

    SHA512

    790b287fce52834927a46b77bb2164f2618151b269a0426019cfaf3430539fc3a6a6fc147bd982583a0724988d483a0f2b2d9d213e68ff1dee56630160a8e897

  • C:\Users\Admin\Pictures\Minor Policy\1J3MoV58JJNrc5Q44YQxEq8u.exe
    MD5

    086fe35804c1c397aa0c338f4ba5b485

    SHA1

    72fb0c1301676f43269dafdd9a0b878d7b6bad97

    SHA256

    de53e9a94cf357293dc9fe81b8ddb4d2e42208db9ef231e9a8ba15987ebc79d2

    SHA512

    790b287fce52834927a46b77bb2164f2618151b269a0426019cfaf3430539fc3a6a6fc147bd982583a0724988d483a0f2b2d9d213e68ff1dee56630160a8e897

  • C:\Users\Admin\Pictures\Minor Policy\1J3MoV58JJNrc5Q44YQxEq8u.exe
    MD5

    086fe35804c1c397aa0c338f4ba5b485

    SHA1

    72fb0c1301676f43269dafdd9a0b878d7b6bad97

    SHA256

    de53e9a94cf357293dc9fe81b8ddb4d2e42208db9ef231e9a8ba15987ebc79d2

    SHA512

    790b287fce52834927a46b77bb2164f2618151b269a0426019cfaf3430539fc3a6a6fc147bd982583a0724988d483a0f2b2d9d213e68ff1dee56630160a8e897

  • C:\Users\Admin\Pictures\Minor Policy\3FFedelFaF2oZIP5tPJyG94J.exe
    MD5

    3aa8b008be30780bd77f4eec5562fbd4

    SHA1

    33020dfda2f81014bb76881ae52dd6bb5e7bb36c

    SHA256

    7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666

    SHA512

    cc785c511602cd619ff7c5a6c94ade07785c9f950f951e04f305df471130b007b8125fe1d92073a4416d30e807938486894c6a9f4954e75f7e4a47637541e8b4

  • C:\Users\Admin\Pictures\Minor Policy\3FFedelFaF2oZIP5tPJyG94J.exe
    MD5

    3aa8b008be30780bd77f4eec5562fbd4

    SHA1

    33020dfda2f81014bb76881ae52dd6bb5e7bb36c

    SHA256

    7e7ab706e39b6ba18df69aef19a43a0787f84e33e9753e9de6d7d1e5fd69b666

    SHA512

    cc785c511602cd619ff7c5a6c94ade07785c9f950f951e04f305df471130b007b8125fe1d92073a4416d30e807938486894c6a9f4954e75f7e4a47637541e8b4

  • C:\Users\Admin\Pictures\Minor Policy\D5l03Sylj3t5AJLTuQ_okNwK.exe
    MD5

    b0643997d99a29ed4245fcedf74bc4b4

    SHA1

    beea4b4cc446f55ebc64c3c4ae0635f3fd3d9246

    SHA256

    bac155c18bbb864341754e6f70aebba7233cb5de3ad224f5f37f0dd0e91b90e9

    SHA512

    b8bb34159620d5e525556f70dba55874075c5ef6e886e1bd4094f57fa84c3d2152a7ad8ce9369b224690328adb16253032abd4176ddc6d0a084a857dd9bda578

  • C:\Users\Admin\Pictures\Minor Policy\D5l03Sylj3t5AJLTuQ_okNwK.exe
    MD5

    b0643997d99a29ed4245fcedf74bc4b4

    SHA1

    beea4b4cc446f55ebc64c3c4ae0635f3fd3d9246

    SHA256

    bac155c18bbb864341754e6f70aebba7233cb5de3ad224f5f37f0dd0e91b90e9

    SHA512

    b8bb34159620d5e525556f70dba55874075c5ef6e886e1bd4094f57fa84c3d2152a7ad8ce9369b224690328adb16253032abd4176ddc6d0a084a857dd9bda578

  • C:\Users\Admin\Pictures\Minor Policy\XIZUb6ao6p5geRweUaDKirvB.exe
    MD5

    c32f362e0dc519926152ae396eef9ae3

    SHA1

    6debe6d2db14ab358a0804b3e4e8d5dc58a85fd1

    SHA256

    67177938219776d00f7462162ac8d77922f813fd21b1a35a71eafbc5796eb268

    SHA512

    ed0489d2225fd67c3fad094e82049ad576d646a2e6c60f455e518d5cac7a3b194691d0d0571f48249bea051d1e73787ae4630023258ef0f38d0b68bfcdb13106

  • C:\Users\Admin\Pictures\Minor Policy\XIZUb6ao6p5geRweUaDKirvB.exe
    MD5

    c32f362e0dc519926152ae396eef9ae3

    SHA1

    6debe6d2db14ab358a0804b3e4e8d5dc58a85fd1

    SHA256

    67177938219776d00f7462162ac8d77922f813fd21b1a35a71eafbc5796eb268

    SHA512

    ed0489d2225fd67c3fad094e82049ad576d646a2e6c60f455e518d5cac7a3b194691d0d0571f48249bea051d1e73787ae4630023258ef0f38d0b68bfcdb13106

  • C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe
    MD5

    35dd45dad308b8dde351ebac5abb29bb

    SHA1

    a4d86c925fd6ac1a5e5304f1b79b153e496c7191

    SHA256

    e7888cabe70d515331ffdc4f34d298f5bcdd3cbd267baf4388949e836ec490f7

    SHA512

    db070bfaf5d1f626a47e7d992e0f07296773d265b7063825ecd251dc90a9297c1c1e523da29b15ea2f71b6be44322fd5c943d11dada671a9f69fcdc3ac1bf367

  • C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe
    MD5

    35dd45dad308b8dde351ebac5abb29bb

    SHA1

    a4d86c925fd6ac1a5e5304f1b79b153e496c7191

    SHA256

    e7888cabe70d515331ffdc4f34d298f5bcdd3cbd267baf4388949e836ec490f7

    SHA512

    db070bfaf5d1f626a47e7d992e0f07296773d265b7063825ecd251dc90a9297c1c1e523da29b15ea2f71b6be44322fd5c943d11dada671a9f69fcdc3ac1bf367

  • C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe
    MD5

    35dd45dad308b8dde351ebac5abb29bb

    SHA1

    a4d86c925fd6ac1a5e5304f1b79b153e496c7191

    SHA256

    e7888cabe70d515331ffdc4f34d298f5bcdd3cbd267baf4388949e836ec490f7

    SHA512

    db070bfaf5d1f626a47e7d992e0f07296773d265b7063825ecd251dc90a9297c1c1e523da29b15ea2f71b6be44322fd5c943d11dada671a9f69fcdc3ac1bf367

  • C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe
    MD5

    35dd45dad308b8dde351ebac5abb29bb

    SHA1

    a4d86c925fd6ac1a5e5304f1b79b153e496c7191

    SHA256

    e7888cabe70d515331ffdc4f34d298f5bcdd3cbd267baf4388949e836ec490f7

    SHA512

    db070bfaf5d1f626a47e7d992e0f07296773d265b7063825ecd251dc90a9297c1c1e523da29b15ea2f71b6be44322fd5c943d11dada671a9f69fcdc3ac1bf367

  • C:\Users\Admin\Pictures\Minor Policy\_wFZw_b_7NBBzMUe66oQSHYT.exe
    MD5

    35dd45dad308b8dde351ebac5abb29bb

    SHA1

    a4d86c925fd6ac1a5e5304f1b79b153e496c7191

    SHA256

    e7888cabe70d515331ffdc4f34d298f5bcdd3cbd267baf4388949e836ec490f7

    SHA512

    db070bfaf5d1f626a47e7d992e0f07296773d265b7063825ecd251dc90a9297c1c1e523da29b15ea2f71b6be44322fd5c943d11dada671a9f69fcdc3ac1bf367

  • C:\Users\Admin\Pictures\Minor Policy\ctZCmjZhUkpEZqskprYgt7tS.exe
    MD5

    c579ffbbe8d6604d01318d6a08e24324

    SHA1

    0f42f48139f2577a17b12fb210cee143301d8e08

    SHA256

    34fd3c1727be1ac43b214e07a1a9c71965e8f06053a5b32919abd362f0df6240

    SHA512

    d0d7d6eb65bfa5fa66575fe87bceb1955cfe9b91d34812d87e289222fa6440578f3b18ecbc6bce5bbe352140a5551fe39ae1772996a0097dfda0a942c05b62d5

  • C:\Users\Admin\Pictures\Minor Policy\ctZCmjZhUkpEZqskprYgt7tS.exe
    MD5

    c579ffbbe8d6604d01318d6a08e24324

    SHA1

    0f42f48139f2577a17b12fb210cee143301d8e08

    SHA256

    34fd3c1727be1ac43b214e07a1a9c71965e8f06053a5b32919abd362f0df6240

    SHA512

    d0d7d6eb65bfa5fa66575fe87bceb1955cfe9b91d34812d87e289222fa6440578f3b18ecbc6bce5bbe352140a5551fe39ae1772996a0097dfda0a942c05b62d5

  • C:\Users\Admin\Pictures\Minor Policy\dCqdhdbh8BTkkk5ss0LFdsuX.exe
    MD5

    742b5f10679cf48e2ecedaace71e4750

    SHA1

    8b2a9eb43d14617e07c15af550351be18196b778

    SHA256

    a010dbebffc12636e3f3269758969ca314b2a893f62a304aa77ed7683d6acabb

    SHA512

    ccd2d6a09aa5e97558a86a701113924d5ab2124ebb4b91aa0f69615d6090909dadca7a46106e896ac4cf9d9a87d7fcc98251c4f26d9c6aae91c9fe0d0eedfc1c

  • C:\Users\Admin\Pictures\Minor Policy\g_0T36pkSKuD0wNNUoJPNFmc.exe
    MD5

    3fc9261a33782d872bdf55ee89cc238c

    SHA1

    f0eae08f5394fd23f52be292259a3ddbc8f04185

    SHA256

    aaa9390e55b509c0bcea76971bbb1fce89580980d84e5bad3e925a39b183caf8

    SHA512

    79e66d85419ca7915bb915aed69d58ff3807057baa867ceac0fd04943af3880982d3f39c9f34a1cbaee07829c21cc406e4a2529784178ec7d31498f40e7c0646

  • C:\Users\Admin\Pictures\Minor Policy\g_0T36pkSKuD0wNNUoJPNFmc.exe
    MD5

    3fc9261a33782d872bdf55ee89cc238c

    SHA1

    f0eae08f5394fd23f52be292259a3ddbc8f04185

    SHA256

    aaa9390e55b509c0bcea76971bbb1fce89580980d84e5bad3e925a39b183caf8

    SHA512

    79e66d85419ca7915bb915aed69d58ff3807057baa867ceac0fd04943af3880982d3f39c9f34a1cbaee07829c21cc406e4a2529784178ec7d31498f40e7c0646

  • C:\Users\Admin\Pictures\Minor Policy\inJe137YJYd59jtqoLTnkfLI.exe
    MD5

    b83a6980985d0acc6fd679147ef77958

    SHA1

    e8a8bb5f129900bdbecdc124291a6711f2b0c662

    SHA256

    cc293d948ea76e5649b9033b5984429c64ee75e06556600f8c834b3c8c4980c2

    SHA512

    0450a7b7daf776057c21b43b45bbc2f1ff0ea124b7f4109b37014d142f216c08707a32ae551d67f45efc77b98987176a5b55a8a8a02b0cb1fe07037ba00d3143

  • C:\Users\Admin\Pictures\Minor Policy\inJe137YJYd59jtqoLTnkfLI.exe
    MD5

    b83a6980985d0acc6fd679147ef77958

    SHA1

    e8a8bb5f129900bdbecdc124291a6711f2b0c662

    SHA256

    cc293d948ea76e5649b9033b5984429c64ee75e06556600f8c834b3c8c4980c2

    SHA512

    0450a7b7daf776057c21b43b45bbc2f1ff0ea124b7f4109b37014d142f216c08707a32ae551d67f45efc77b98987176a5b55a8a8a02b0cb1fe07037ba00d3143

  • C:\Users\Admin\Pictures\Minor Policy\jGtZ9NqV1iA1L3i8PK_rRowh.exe
    MD5

    9519c85c644869f182927d93e8e25a33

    SHA1

    eadc9026e041f7013056f80e068ecf95940ea060

    SHA256

    f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

    SHA512

    dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

  • C:\Users\Admin\Pictures\Minor Policy\jGtZ9NqV1iA1L3i8PK_rRowh.exe
    MD5

    9519c85c644869f182927d93e8e25a33

    SHA1

    eadc9026e041f7013056f80e068ecf95940ea060

    SHA256

    f0dc8fa1a18901ac46f4448e434c3885a456865a3a309840a1c4ac67fd56895b

    SHA512

    dcc1dd25bba19aaf75ec4a1a69dc215eb519e9ee3b8f7b1bd16164b736b3aa81389c076ed4e8a17a1cbfaec2e0b3155df039d1bca3c7186cfeb9950369bccf23

  • C:\Users\Admin\Pictures\Minor Policy\tnBi_LPXrPOdRfvXJLGNWbux.exe
    MD5

    095ea376185f14059ddb07073003e56c

    SHA1

    fe64a20fdf9325d7d5b14258e77aba1b5502550e

    SHA256

    f08b3a925566dc86f7be4986161b016083df3b388bd60ddd41acd29090af565c

    SHA512

    11244b3939873a81903d74bcb58a6c357228c3e314586cb6c8a65b71d02d943aa6b9b5d96b483306d6310c41231d028fefc0c30d18cc50874ffb51843af15c34

  • C:\Users\Admin\Pictures\Minor Policy\tnBi_LPXrPOdRfvXJLGNWbux.exe
    MD5

    095ea376185f14059ddb07073003e56c

    SHA1

    fe64a20fdf9325d7d5b14258e77aba1b5502550e

    SHA256

    f08b3a925566dc86f7be4986161b016083df3b388bd60ddd41acd29090af565c

    SHA512

    11244b3939873a81903d74bcb58a6c357228c3e314586cb6c8a65b71d02d943aa6b9b5d96b483306d6310c41231d028fefc0c30d18cc50874ffb51843af15c34

  • C:\Windows\SysWOW64\GroupPolicylHIUi\gpt.ini
    MD5

    ec3584f3db838942ec3669db02dc908e

    SHA1

    8dceb96874d5c6425ebb81bfee587244c89416da

    SHA256

    77c7c10b4c860d5ddf4e057e713383e61e9f21bcf0ec4cfbbc16193f2e28f340

    SHA512

    35253883bb627a49918e7415a6ba6b765c86b516504d03a1f4fd05f80902f352a7a40e2a67a6d1b99a14b9b79dab82f3ac7a67c512ccf6701256c13d0096855e

  • C:\Windows\system32\GroupPolicy\Machine\Registry.pol
    MD5

    cdfd60e717a44c2349b553e011958b85

    SHA1

    431136102a6fb52a00e416964d4c27089155f73b

    SHA256

    0ee08da4da3e4133e1809099fc646468e7156644c9a772f704b80e338015211f

    SHA512

    dfea0d0b3779059e64088ea9a13cd6b076d76c64db99fa82e6612386cae5cda94a790318207470045ef51f0a410b400726ba28cb6ecb6972f081c532e558d6a8

  • C:\Windows\system32\GroupPolicy\gpt.ini
    MD5

    a62ce44a33f1c05fc2d340ea0ca118a4

    SHA1

    1f03eb4716015528f3de7f7674532c1345b2717d

    SHA256

    9f2cd4acf23d565bc8498c989fccccf59fd207ef8925111dc63e78649735404a

    SHA512

    9d9a4da2df0550afdb7b80be22c6f4ef7da5a52cc2bb4831b8ff6f30f0ee9eac8960f61cdd7cfe0b1b6534a0f9e738f7eb8ea3839d2d92abeb81660de76e7732

  • memory/116-168-0x0000000000000000-mapping.dmp
  • memory/116-305-0x0000000000000000-mapping.dmp
  • memory/116-182-0x0000000004FE0000-0x0000000005584000-memory.dmp
  • memory/116-176-0x0000000000170000-0x0000000000228000-memory.dmp
  • memory/728-187-0x0000000000000000-mapping.dmp
  • memory/1152-214-0x0000000000400000-0x0000000000428000-memory.dmp
  • memory/1152-222-0x00000000074C0000-0x0000000007AD8000-memory.dmp
  • memory/1152-244-0x00000000059B0000-0x0000000005A42000-memory.dmp
  • memory/1152-286-0x000000000A930000-0x000000000AAF2000-memory.dmp
  • memory/1152-202-0x0000000000000000-mapping.dmp
  • memory/1152-292-0x000000000B030000-0x000000000B55C000-memory.dmp
  • memory/1152-320-0x00000000090F0000-0x0000000009166000-memory.dmp
  • memory/1152-225-0x00000000072E0000-0x000000000731C000-memory.dmp
  • memory/1152-223-0x0000000007050000-0x000000000715A000-memory.dmp
  • memory/1152-224-0x0000000007280000-0x0000000007292000-memory.dmp
  • memory/1152-322-0x0000000009170000-0x00000000091C0000-memory.dmp
  • memory/1152-246-0x0000000005A50000-0x0000000005AB6000-memory.dmp
  • memory/1220-315-0x0000000000710000-0x0000000000739000-memory.dmp
  • memory/1220-297-0x0000000000000000-mapping.dmp
  • memory/1220-316-0x00000000007F0000-0x0000000000837000-memory.dmp
  • memory/1632-229-0x0000000000000000-mapping.dmp
  • memory/1768-198-0x0000000002238000-0x00000000022CA000-memory.dmp
  • memory/1768-151-0x0000000000000000-mapping.dmp
  • memory/1768-201-0x00000000022D0000-0x00000000023EB000-memory.dmp
  • memory/1816-153-0x0000000000000000-mapping.dmp
  • memory/1856-190-0x0000000000000000-mapping.dmp
  • memory/2100-209-0x0000000000710000-0x000000000074F000-memory.dmp
  • memory/2100-210-0x0000000000400000-0x0000000000597000-memory.dmp
  • memory/2100-250-0x0000000000400000-0x0000000000597000-memory.dmp
  • memory/2100-206-0x00000000007BC000-0x00000000007E3000-memory.dmp
  • memory/2100-249-0x00000000007BC000-0x00000000007E3000-memory.dmp
  • memory/2100-152-0x0000000000000000-mapping.dmp
  • memory/2136-140-0x0000000000A60000-0x00000000015E7000-memory.dmp
  • memory/2136-143-0x0000000000A60000-0x00000000015E7000-memory.dmp
  • memory/2136-142-0x00000000774A0000-0x0000000077643000-memory.dmp
  • memory/2136-144-0x0000000000A60000-0x00000000015E7000-memory.dmp
  • memory/2136-141-0x0000000000A60000-0x00000000015E7000-memory.dmp
  • memory/2136-145-0x0000000000A60000-0x00000000015E7000-memory.dmp
  • memory/2136-146-0x00000000774A0000-0x0000000077643000-memory.dmp
  • memory/2136-185-0x0000000000A60000-0x00000000015E7000-memory.dmp
  • memory/2136-186-0x00000000774A0000-0x0000000077643000-memory.dmp
  • memory/2136-133-0x0000000000A60000-0x00000000015E7000-memory.dmp
  • memory/2136-139-0x0000000000A60000-0x00000000015E7000-memory.dmp
  • memory/2136-132-0x0000000000A60000-0x00000000015E7000-memory.dmp
  • memory/2188-154-0x0000000000000000-mapping.dmp
  • memory/2272-226-0x0000000000000000-mapping.dmp
  • memory/2288-302-0x0000000000000000-mapping.dmp
  • memory/2300-231-0x0000000000000000-mapping.dmp
  • memory/2396-234-0x0000000000000000-mapping.dmp
  • memory/2996-149-0x0000000000000000-mapping.dmp
  • memory/2996-179-0x0000000140000000-0x000000014060E000-memory.dmp
  • memory/3004-243-0x00000000040F0000-0x0000000004344000-memory.dmp
  • memory/3004-254-0x00000000040F0000-0x0000000004344000-memory.dmp
  • memory/3004-230-0x0000000000000000-mapping.dmp
  • memory/3364-169-0x0000000000000000-mapping.dmp
  • memory/3460-308-0x0000000000000000-mapping.dmp
  • memory/3512-194-0x00000000006BC000-0x00000000006CD000-memory.dmp
  • memory/3512-148-0x0000000000000000-mapping.dmp
  • memory/3512-205-0x0000000000400000-0x0000000000580000-memory.dmp
  • memory/3512-195-0x0000000000690000-0x0000000000699000-memory.dmp
  • memory/3512-227-0x0000000000400000-0x0000000000580000-memory.dmp
  • memory/3572-323-0x0000000000000000-mapping.dmp
  • memory/3848-228-0x0000000000000000-mapping.dmp
  • memory/4004-172-0x0000000000000000-mapping.dmp
  • memory/4020-295-0x00000000032F0000-0x00000000033F5000-memory.dmp
  • memory/4020-253-0x00000000034C0000-0x000000000356A000-memory.dmp
  • memory/4020-197-0x0000000000000000-mapping.dmp
  • memory/4020-247-0x00000000030D0000-0x00000000031D9000-memory.dmp
  • memory/4020-248-0x00000000032F0000-0x00000000033F5000-memory.dmp
  • memory/4020-252-0x0000000003400000-0x00000000034BF000-memory.dmp
  • memory/4040-235-0x0000000000000000-mapping.dmp
  • memory/4080-238-0x0000000000000000-mapping.dmp
  • memory/4344-147-0x0000000000000000-mapping.dmp
  • memory/4360-311-0x0000000000400000-0x000000000045B000-memory.dmp
  • memory/4360-310-0x0000000000000000-mapping.dmp
  • memory/4360-348-0x0000000000400000-0x000000000045B000-memory.dmp
  • memory/4360-327-0x0000000061E00000-0x0000000061EF3000-memory.dmp
  • memory/4360-313-0x0000000000400000-0x000000000045B000-memory.dmp
  • memory/4360-314-0x0000000000400000-0x000000000045B000-memory.dmp
  • memory/4360-321-0x0000000000400000-0x000000000045B000-memory.dmp
  • memory/4508-306-0x0000000000000000-mapping.dmp
  • memory/4536-237-0x0000000000000000-mapping.dmp
  • memory/4668-204-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4668-199-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4668-208-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4668-251-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4668-196-0x0000000000000000-mapping.dmp
  • memory/4668-269-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4668-218-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4688-200-0x0000000010000000-0x0000000010B5F000-memory.dmp
  • memory/4688-191-0x0000000000000000-mapping.dmp
  • memory/4828-236-0x0000000000000000-mapping.dmp
  • memory/4932-287-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4932-279-0x0000000000000000-mapping.dmp
  • memory/4932-282-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4932-325-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4932-284-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/4952-221-0x0000000000F00000-0x0000000000F20000-memory.dmp
  • memory/4952-217-0x0000000000000000-mapping.dmp
  • memory/5024-150-0x0000000000000000-mapping.dmp
  • memory/5192-347-0x0000000000000000-mapping.dmp
  • memory/5244-349-0x0000000000000000-mapping.dmp
  • memory/5308-352-0x0000000000000000-mapping.dmp
  • memory/5328-355-0x0000000000000000-mapping.dmp
  • memory/5372-356-0x0000000010000000-0x0000000010B5F000-memory.dmp
  • memory/5460-365-0x0000000004FE0000-0x0000000004FFE000-memory.dmp
  • memory/5460-360-0x0000000000000000-mapping.dmp
  • memory/5460-364-0x0000000004910000-0x0000000004976000-memory.dmp
  • memory/5460-363-0x0000000004110000-0x0000000004132000-memory.dmp
  • memory/5460-362-0x00000000041E0000-0x0000000004808000-memory.dmp
  • memory/5460-361-0x0000000003A10000-0x0000000003A46000-memory.dmp
  • memory/5588-366-0x0000000000000000-mapping.dmp
  • memory/5600-367-0x0000000000000000-mapping.dmp
  • memory/5620-368-0x0000000000000000-mapping.dmp
  • memory/5652-385-0x0000000002A30000-0x0000000002BBC000-memory.dmp
  • memory/5652-370-0x0000000000000000-mapping.dmp
  • memory/5676-372-0x0000000000000000-mapping.dmp
  • memory/5696-373-0x0000000000000000-mapping.dmp
  • memory/5712-374-0x0000000000000000-mapping.dmp
  • memory/5732-375-0x0000000000000000-mapping.dmp
  • memory/5744-376-0x0000000000000000-mapping.dmp
  • memory/5768-378-0x0000000000000000-mapping.dmp
  • memory/5788-379-0x0000000000000000-mapping.dmp
  • memory/5800-380-0x0000000000000000-mapping.dmp
  • memory/5844-381-0x0000000000000000-mapping.dmp
  • memory/5888-382-0x00000000012D0000-0x0000000001345000-memory.dmp
  • memory/5888-383-0x0000000001260000-0x00000000012CB000-memory.dmp
  • memory/6004-384-0x0000000000DE0000-0x0000000000DEC000-memory.dmp
  • memory/6416-387-0x0000000000400000-0x0000000000537000-memory.dmp
  • memory/25664-239-0x0000000000000000-mapping.dmp
  • memory/25728-240-0x0000000000000000-mapping.dmp
  • memory/56116-242-0x0000000000000000-mapping.dmp
  • memory/59404-245-0x0000000000000000-mapping.dmp
  • memory/66456-324-0x00007FFA054E0000-0x00007FFA05FA1000-memory.dmp
  • memory/66456-294-0x000002AFA9E60000-0x000002AFA9E82000-memory.dmp
  • memory/66456-293-0x00007FFA054E0000-0x00007FFA05FA1000-memory.dmp
  • memory/83412-257-0x0000000000000000-mapping.dmp
  • memory/97588-326-0x0000000002FC0000-0x00000000030C5000-memory.dmp
  • memory/97588-309-0x0000000002780000-0x000000000283F000-memory.dmp
  • memory/97588-259-0x0000000000000000-mapping.dmp
  • memory/97588-301-0x0000000002FC0000-0x00000000030C5000-memory.dmp
  • memory/97588-317-0x00000000030D0000-0x000000000317A000-memory.dmp
  • memory/97588-300-0x0000000002DA0000-0x0000000002EA9000-memory.dmp
  • memory/97608-260-0x0000000000000000-mapping.dmp
  • memory/101204-263-0x0000000000400000-0x0000000000428000-memory.dmp
  • memory/101204-261-0x0000000000000000-mapping.dmp
  • memory/101288-268-0x0000000000000000-mapping.dmp
  • memory/101288-283-0x000000000226E000-0x0000000002300000-memory.dmp
  • memory/101364-278-0x00007FFA054E0000-0x00007FFA05FA1000-memory.dmp
  • memory/101364-273-0x0000000000000000-mapping.dmp
  • memory/101364-296-0x00007FFA054E0000-0x00007FFA05FA1000-memory.dmp
  • memory/101364-275-0x000001C2F94F0000-0x000001C2F9648000-memory.dmp
  • memory/101364-277-0x000001C2FBA10000-0x000001C2FBA52000-memory.dmp