85a9994901d9335195e4e98cf07be49e0ab74f837e6cdb56d02e4d86b433f401

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/10/2026, 20:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 34.6MB
Sample261022-zfr5qafv21
SHA256 85a9994901d9335195e4e98cf07be49e0ab74f837e6cdb56d02e4d86b433f401
MD5 fcb39af083fe26a970fcc384e7b7d0be
SHA1 069698dbc62ff10c6aafe3cf6c79023b3c534424
SHA512 f44cfd8328f29024e404600e796ac2f825cd7494215793f3050e9ec8d47beb27f8132d5a09a05da199770cbf3dca0c9cf5b40dada05ee619a869d2880ec21eff
SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgAh:6ukQmH0HmKxofM3nl6UfMYrLgAh
TLSH
T1CE876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yilEjH.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\5XReIP = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-747854149-4118156852-591593384-1000\Control Panel\International\Geo\Nation	bUdXag.exe

Executes dropped EXE 4 IoCs

pid	Process
3628	bUdXag.exe
2128	bUdXag.exe
4156	yilEjH.exe
2908	yilEjH.exe

Loads dropped DLL 4 IoCs

pid	Process
3628	bUdXag.exe
2128	bUdXag.exe
4156	yilEjH.exe
2908	yilEjH.exe

Modifies file permissions 1 TTPs 1 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2852	icacls.exe

Adds Run key to start application 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\5XReIP\\bUdXag.exe\""	bUdXag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\5XReIP\\bUdXag.exe\""	bUdXag.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\yilEjH\\yilEjH.exe\""	yilEjH.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1428	cmd.exe
1456	cmd.exe
624	cmd.exe
2440	cmd.exe
2872	cmd.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	bUdXag.exe
File opened for modification	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	bUdXag.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\yilEjH	bUdXag.exe
File created	C:\Program Files (x86)\yilEjH\XPSPLOG.dll	bUdXag.exe
File created	C:\Program Files (x86)\yilEjH\image.png	bUdXag.exe
File opened for modification	C:\Program Files (x86)\yilEjH\XPSPLOG.dll	bUdXag.exe
File opened for modification	C:\Program Files (x86)\yilEjH\image.png	bUdXag.exe
File opened for modification	C:\Program Files (x86)\yilEjH\thumbs.db	bUdXag.exe
File created	C:\Program Files (x86)\yilEjH\yilEjH.exe	bUdXag.exe
File created	C:\Program Files (x86)\yilEjH\thumbs.db	bUdXag.exe
File opened for modification	C:\Program Files (x86)\yilEjH\yilEjH.exe	bUdXag.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 6 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3940	cmd.exe
2216	cmd.exe
2280	cmd.exe
2372	cmd.exe
4468	cmd.exe
4108	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bUdXag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bUdXag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bUdXag.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bUdXag.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yilEjH.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	yilEjH.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3056	schtasks.exe
3636	schtasks.exe
2468	schtasks.exe
4572	schtasks.exe
952	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3120	install.2.0.02.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe
3628	bUdXag.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3628 wrote to memory of 1428	3628	bUdXag.exe	95
PID 1428 wrote to memory of 3056	1428	cmd.exe	97
PID 1428 wrote to memory of 4104	1428	cmd.exe	98
PID 1428 wrote to memory of 4320	1428	cmd.exe	100
PID 3628 wrote to memory of 1456	3628	bUdXag.exe	104
PID 4108 wrote to memory of 2620	4108	cmd.exe	106
PID 3628 wrote to memory of 624	3628	bUdXag.exe	107
PID 1456 wrote to memory of 3636	1456	cmd.exe	110
PID 624 wrote to memory of 2468	624	cmd.exe	112
PID 1456 wrote to memory of 2808	1456	cmd.exe	113
PID 624 wrote to memory of 212	624	cmd.exe	114
PID 1456 wrote to memory of 1816	1456	cmd.exe	116
PID 624 wrote to memory of 4336	624	cmd.exe	117
PID 3628 wrote to memory of 2440	3628	bUdXag.exe	118
PID 2440 wrote to memory of 4572	2440	cmd.exe	120
PID 3940 wrote to memory of 4088	3940	cmd.exe	122
PID 3628 wrote to memory of 2872	3628	bUdXag.exe	123
PID 2440 wrote to memory of 3272	2440	cmd.exe	125
PID 2872 wrote to memory of 952	2872	cmd.exe	127
PID 2440 wrote to memory of 2284	2440	cmd.exe	128
PID 2872 wrote to memory of 312	2872	cmd.exe	129
PID 2872 wrote to memory of 2600	2872	cmd.exe	131
PID 2216 wrote to memory of 716	2216	cmd.exe	132
PID 3628 wrote to memory of 4156	3628	bUdXag.exe	133

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	yilEjH.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3120

C:\Users\Public\5XReIP\bUdXag.exe
C:\Users\Public\5XReIP\bUdXag.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\5XReIP\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\5XReIP\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4104
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4320
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1816
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:624
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:212
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4336
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2440
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4572
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3272
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2284
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:952
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:312
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2600
- C:\Program Files (x86)\yilEjH\yilEjH.exe
  "C:\Program Files (x86)\yilEjH\yilEjH.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:4156
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:2280
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\yilEjH" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2372
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\yilEjH" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2852
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4468

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\5XReIP" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\5XReIP" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2620

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3148

C:\Users\Public\5XReIP\bUdXag.exe
"C:\Users\Public\5XReIP\bUdXag.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Reads the TCP/IP host and domain name from the registry
PID:2128

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3940
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4088

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2216
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:716

C:\Program Files (x86)\yilEjH\yilEjH.exe
"C:\Program Files (x86)\yilEjH\yilEjH.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2908

C:\Program Files (x86)\r0W3006A\K866Ax.exe
"C:\Program Files (x86)\r0W3006A\K866Ax.exe"
1⤵
PID:2344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\r0W3006A\XPSPLOG.dll
Size 1.9MB
SHA256 8617b27e102034ed85d88ef8233a2753955f0eba864b907f2158afe5eea2da70
MD5 bf21412939c4bed6322f7bf2f1555068
SHA1 17a078e0fe9afecb601b0dc09cb3698e19e0fa37
SHA512 ed6bdb81aaa9868402b22dccd0589e10e24e5ae014ad701065376916fe320f5af4bdb4c3adf45a56e810f7f4b67240bc148c5b722de4373ca640c6d644333b2a
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefB:yCMWmcKfST5t+Bcek
TLSH
T11795338BB2D7421EF59133B92F5CEC5DB07E48C882BDD955D8A2714B1031B6E903AB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\r0W3006A\XPSPLOG.dll
Size 1.2MB
SHA256 7f5aaa8b254582b4ee320685f627d9bbf4363f475ac984182709826b8630b04f
MD5 f9c6fbd1eea18208c34a66611f63f6ee
SHA1 57ca151ad741b778376cc44fbb929e2284a03c8f
SHA512 5d1e12308e92a84374a4492a974adfdd2e21dc30c446c9f125b7205b81ad4bb5923ce5db5bf637bb4750833f9caf38e8f1e5d3d9bfed814b737bc55c7fccd0b8
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXTb:3KLKP3cCMWmRqKJ1JNSTb
TLSH
T16A4523C67187A629F646B3716F8DFE2CB5BE9CC441BDD829A4D5748700369FA403838E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\r0W3006A\XPSPLOG.dll
Size 1.1MB
SHA256 c45c214799b6f003569e69cfdf32ba8a757a6c68c320b56a059541af12e54fad
MD5 37f8fc528745cb624a81f03b6e0faa95
SHA1 270a8dd4a59cec9fdbee7b83f39e237d6082cb18
SHA512 2d3da47af91366ef3793ff372ddfdb209b848ee1c83fb26ba1af0b21fc1270e1586383b75195bb6190184f2ccfd5ee4e1352b57f2491c0ae8693550d6335fbb5
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXr:3KLKP3cCMWmRqKJ1JNSr
TLSH
T1833523D661CB512DEA55B3717F8DFD2CB4B998C801B9D819E8D571874032AFB903C28E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\yilEjH\XPSPLOG.dll
Size 4.6MB
SHA256 dfd81e222fb8d8f1ef09c8ddf20312e8c5fd8f8d8bfe35ef8c02ae5bd37ed2f6
MD5 da1d4d25969b76dcce94350bd02674b1
SHA1 dd231a206560668eec49b895aea895122f508aa5
SHA512 b120aeb7f87dc1f807a258a720bb3d7e1f66848d5d9dbbbdd6a9eb7878a7d9da0ac0af1a7c2d1809719ccc7e8f2f13b6d5260caff927fe757e1314f76b9890fa
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyT:BMWKfU+BcUTHCCCfqCiUffnT
TLSH
T1BC263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\yilEjH\image.png
Size 4.8MB
SHA256 0b77494ede87a2e24d8d71ba5d68ca0f359657b7ca9fa287cd72346443637dfa
MD5 1bf78098227fd17796c770792f7a8922
SHA1 29642e87fa71f69a5b08f992fdd12de10877609b
SHA512 e963f97d9b0cfd46accc3010ee2495f12adbd63d488c418d04710055a756b7d4da7ecb4df4534922fe114c965e264906f97f7026bb2586c72f9343aea9f0647b
SSDEEP 98304:o/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:oMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1B636334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\yilEjH\thumbs.db
Size 358KB
SHA256 12eb920e658e0e93aa642a0f922c6f3ecf765a9e200ed1d79ababd4a0106cc1a
MD5 15d68cbf8b0c2676e7a1068f1362f528
SHA1 45420e7bcdd302f8b883a3e49a4eed3c7dbdbd5c
SHA512 5cb26a46d30a85353b7fffca7e94f98e14796f852be270783bee8f13491b013f5e0bec78c24f15973decbfa83dc346a7f05f23679aa88ffe6749a32656f1a8c6
SSDEEP 6144:riACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:u8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T13A74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

yilEjH.exe

Path C:\Program Files (x86)\yilEjH\yilEjH.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

01C6E817D6CDFECAEC27F2EB1524A7A6_0CD747E0A6A12A527D90046BB9107C3E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_0CD747E0A6A12A527D90046BB9107C3E
Size 1KB
SHA256 340656fc57eb15ebdfde6c9b8362c4d10c81b71953d26fa9328be210ac60ef29
MD5 50afe37bcd6c41ed31f8a8be721e72f6
SHA1 ad5b3962d6c26e67bc7ac3f53e287d4b5e65f31c
SHA512 d8d35d5e1f4cc27770b25a0f5aae3bfec4596ddd77c2f3be431306cff39472e11cb74139b8af6fd78414f71c35249254ddf523227f2f5bb0209e8a0866fba14b
TLSH
T10E21C6697A39F5163E085E8A1CC4A7338CB036CDDCA5EC125409D2ABB1423839FC580E
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 cfa627a820998f21233960f253d38c89335ba7278141bcf80be053c7641730bc
MD5 95e4335e7b2692065a0548d2bf594c3d
SHA1 63792d356404e5aae5562007d4dacf20f09f2552
SHA512 c519c5050e71d6d591feadf3ac317ed3ccc86b194f5c132e108d132515e87b21f5fa9db050399551b30e8c955cfaa2dd4eb975c0dcff904636c19cb3a0d1d2e8
TLSH
T1F231A4BB0F7979C6AF394D8815CDE0315DE9E2801DC610AA2159C0785F483B26F1E008
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 ba7b10fbba92c986ca68ecf228df57e8de4c29661665f38549191176d18ef033
MD5 02fc636bb25d33ff9725e7e455e69dc0
SHA1 0c4b8d00607e3765ff42dcf18e3577b46f8c8dda
SHA512 17fa7cdced5b79e174297d516de6200bef001b43f300a85a0d39e8c3432c092503ee83ad153dc95aeeb59937881af03ed2433de1c39d5be42c2328e573e8b8b7
TLSH
T13831B6E64F791042FF284FB592C0C63B7CF5A2258EF82841667EC26A5605777AF85005
MD5 SHA1 SHA512 TLSH

Submit Download

01C6E817D6CDFECAEC27F2EB1524A7A6_0CD747E0A6A12A527D90046BB9107C3E

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_0CD747E0A6A12A527D90046BB9107C3E
Size 542B
SHA256 7bee0f630d5cfe66cda1b26837929cf86fa4b00930498b2749c7ff1ff1bfe975
MD5 a3c9f69b2dc3669c9e64b1a80fb1a933
SHA1 85eaf78ee5abf77bee2f553701ca0d4721b98863
SHA512 3a286997806f8b4c87f7925122d6d0ba780fa1a8220bc2e0a96b1b73b421fe170194cabc4f38ae6f8092852faf27b899d1e0cc275bfc4520b40a802e0531374b
TLSH
T1EDF0976C98BA801CF037DCB81BD475B2AF25FA1638400A751ED44B487A2DC00FCE2A15
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 5b02d8824baabceebe842f72f29b38b93106bd05ef454bc5ba9215f8380c149d
MD5 64ca2fa8907bcc67a02cf985fb29b90c
SHA1 061872ec878bd6c15c06c70d4ffee7c646b743db
SHA512 5a53bccf68683f0cf1047e6fc487e366f663555f01e4de612f1e4b80cc55851d679efd937a1698fc03db6ffc4fa45a2ceaf14203f773b449a0cd8440e217c24f
TLSH
T1E6F0DC1C48BC523EF233D93843D57423763FFA0B300A85A442E5070CE21A9013C92539
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 367d6ad4504dcace2eddf9c26cf1dea489c0db6f4155bde10c55db18cda7adb7
MD5 11ec9f5afbccadaa6fb8dc7f771a261a
SHA1 b07cdc240429083aa25970eb8070934384c3f678
SHA512 613dffad050e95e06f1c6af5bfd03c6c56f1d5529f9b0873af293fac231aca0b93dccd3ccf836a05b85baa2e6744006c1375fc5382e57af0df8735ce4e591b0c
TLSH
T1A3F0A33582ED011FF17AAEB857C735736D3AE622100612BF0BE903442E56D015C81238
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\5XReIP\UxEnhance64.dll
Size 3.1MB
SHA256 1c9de6eb86fc3b336a3d01a98b88b4a7218b05202754479e1f502d3596f21f8c
MD5 84027c6cde3783f0265861173b3434c1
SHA1 9046da280ea738ac310dd30db175bcba1ec34acb
SHA512 d0f3aad3b924158afb4555b7d6a769ffccecb1aa75dc14b4a811e791379f6f28b97bd70ffac22d5e471ece2bf80393575597a0b435351725fc27299adf10fccb
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+j:P9m29xx3Tiqt06ox6+z2rNNrKoj
TLSH
T16AE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\5XReIP\adoresd.dat
Size 4.8MB
SHA256 54e5ac2745f73ab6ab8055835293825166c7f93459983790b6ecff7664ebb1c3
MD5 cda8c7ecce2b6a83e11d79d05149317a
SHA1 4449c60a7b81a670e46417528ccaa1cc35ed7e25
SHA512 02fd6b9fde0f0808a34b3fa5ac767206a8db563c0c569fb99fd166365cab93e9d0e108bdd60e2caf677895f58824af35f68b510c82596051b9a421f025b836ee
SSDEEP 98304:TWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:TWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1AD3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bUdXag.exe

Path C:\Users\Public\5XReIP\bUdXag.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\5XReIP\msadox.tb
Size 8KB
SHA256 f91c70d579689534de3cd8740f48272b6b877ff87fa433915acedb32a776415f
MD5 b373c050c34f82f3d3045a689aaa4ac5
SHA1 0b51c3f17546ba27aea7f6cecddff649910721b7
SHA512 3f09fca709421bb686d264b069ab29639726c1be5b0425b4852c30d40aec6b8d69d326f34a72f16c98e4b73823ec37f0b645c949c0bd1690408b8d5a53409a0d
SSDEEP 192:0qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:0sZqZOXQ3uqvR2Kfzp
TLSH
T1B6029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 1B
SHA256 084fed08b978af4d7d196a7446a86b58009e636b611db16211b65a9aadff29c5
MD5 8666683506aacd900bbd5a74ac4edf68
SHA1 9842926af7ca0a8cca12604f945414f07b01e13d
SHA512 e45bf5817ddf94aa2f7a407071f0eedc6beb98f768b4cd33d1176d44d1563a45a5d7212290eb7670c6786b13591aedac86478993895e8b24e612014abaa6ba04
MD5 SHA1 SHA512

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 23cfea09624d0880dc8dc30bf5fda8cd9ff7bf4770a119425a6995e15563b865
MD5 5c2725d9e3c4d6501a99b1c47d9818c8
SHA1 4601b0b638c2f6a33986fceb536bd8c731c088e2
SHA512 d56734933f1eb2a646b7b47e397c7134cf69707ac1a3563a6aa132aa4b40536489ff9f6e633e14a8f1507ff9cd4dfd9c164648915061d0fe66cb9caafeb0f184
MD5 SHA1 SHA512

Submit Download

SiPolicy.p7b

Path C:\Windows\System32\CodeIntegrity\SiPolicy.p7b
Size 24KB
SHA256 b3f17065ed63b17ffef175f2979907d8eef69a76ba4cbd1d9785035a0b1f0a10
MD5 c99441a9b83d3866d88abfdf45894d3d
SHA1 3e32a4131855a8296b6238294a03d8eabcad6f9c
SHA512 c13bb76ef20055b5e923272c4cd976e93e5f21c5b7f8664e5d60a4918e92d0ab4abd3efa63a549b52536986fc3434a9ef1f808be76a12f47e43fdd9e58f275f6
SSDEEP 48:GwIn0NHUVyHU1yHUccy3GwaAvdV6dVwNdVojdVKdVqdmded9dod1d9Ud0dOdbd81:Any8yU88yldGVDP4NMC2/22M/0rw
TLSH
T11CB2C6803BEEC559F3B3DA71AFB6C6AA903AFC91AD11531F71C9735E1432800D529B62
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2128-586-0x00007FFBD8DA0000-0x00007FFBD8DA2000-memory.dmp

Download

memory/2128-610-0x00000155A0000000-0x00000155A008A000-memory.dmp

Download

memory/2128-618-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/2128-617-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/2128-609-0x00000155A0000000-0x00000155A008A000-memory.dmp

Download

memory/2128-612-0x00000155A0000000-0x00000155A008A000-memory.dmp

Download

memory/2128-611-0x00000155A0000000-0x00000155A008A000-memory.dmp

Download

memory/2128-606-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/2128-599-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/2128-592-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/2128-594-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/2128-593-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/2128-581-0x00007FFBBABA0000-0x00007FFBBB0BE000-memory.dmp

Download

memory/2128-584-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/2128-587-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/2128-591-0x000001559F5B0000-0x000001559FE87000-memory.dmp

Download

memory/3120-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/3120-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/3120-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/3120-504-0x00007FFBC9A80000-0x00007FFBC9A90000-memory.dmp

Download

memory/3120-525-0x00007FFBC9A80000-0x00007FFBC9A90000-memory.dmp

Download

memory/3120-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/3628-539-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-530-0x00007FFBD8D90000-0x00007FFBD8D92000-memory.dmp

Download

memory/3628-546-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-558-0x0000029556ED0000-0x0000029556F5A000-memory.dmp

Download

memory/3628-561-0x0000029556ED0000-0x0000029556F5A000-memory.dmp

Download

memory/3628-560-0x0000029556ED0000-0x0000029556F5A000-memory.dmp

Download

memory/3628-563-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-565-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-545-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-543-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-555-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-536-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-531-0x00007FFBBABA0000-0x00007FFBBB0BE000-memory.dmp

Download

memory/3628-544-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-538-0x00007FFBD8DA0000-0x00007FFBD8DA2000-memory.dmp

Download

memory/3628-557-0x0000029556DF0000-0x0000029556E3E000-memory.dmp

Download

memory/3628-550-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-596-0x0000029556020000-0x00000295568F7000-memory.dmp

Download

memory/3628-559-0x0000029556ED0000-0x0000029556F5A000-memory.dmp

Download

memory/4156-706-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4156-709-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4156-716-0x0000000000D50000-0x0000000000D64000-memory.dmp

Download

memory/4156-719-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4156-704-0x0000000000B80000-0x0000000000B81000-memory.dmp

Download

memory/4156-702-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4156-732-0x00000000033D0000-0x0000000003BAD000-memory.dmp

Download

memory/4156-734-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4156-696-0x0000000075410000-0x0000000075B5A000-memory.dmp

Download

memory/4156-695-0x0000000000B60000-0x0000000000B61000-memory.dmp

Download