8da5c864463909860e0b2b28c2029d9486479b769d2645f138b7c597b0a47279

Analysis

max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.02.exe
Size 38.9MB
Sample261024-vr61sscy9n
SHA256 8da5c864463909860e0b2b28c2029d9486479b769d2645f138b7c597b0a47279
MD5 c0f0e52a0daca2787f7df47dbec572c9
SHA1 0356405e816475782c7365c3a1afca042f66d269
SHA512 05e0149e6c05f12a1f958ab061cbad5c29e829fb0961cfdb4317f66217c38dce981bbf17b2994c001af913d9a18c7009e622a8bf7b27f09306aceb0b1f69d961
SSDEEP 49152:qPnycXVTyTyg5tJyNZ/W/hNbo1iTl8ZFPnMBwbePbgF+VS5sb5m+cZ2lyn0wgsXB:q6chqTShW/hNbSiQfMJPLmrUlsB
TLSH
T1E197D69FBF81DE82F957D23498A75B602336D9B40BF1C307125427206F9F2998EE25D8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WXTVEu.exe

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\rzTizz = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
996	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	WXTVEu.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	WXTVEu.exe

Executes dropped EXE 8 IoCs

pid	Process
5500	2Nrmdb.exe
2712	2Nrmdb.exe
3832	WXTVEu.exe
3268	WXTVEu.exe
5164	WXTVEu.exe
780	1NfwgliO.exe
4064	WXTVEu.exe
6124	1NfwgliO.exe

Loads dropped DLL 8 IoCs

pid	Process
5500	2Nrmdb.exe
2712	2Nrmdb.exe
3832	WXTVEu.exe
3268	WXTVEu.exe
5164	WXTVEu.exe
780	1NfwgliO.exe
4064	WXTVEu.exe
6124	1NfwgliO.exe

Modifies file permissions 1 TTPs 15 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4164	icacls.exe
4340	icacls.exe
5764	icacls.exe
1356	icacls.exe
4400	icacls.exe
2424	icacls.exe
1372	icacls.exe
1960	icacls.exe
3668	icacls.exe
1416	icacls.exe
2460	icacls.exe
5872	icacls.exe
4940	icacls.exe
3652	icacls.exe
2712	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\rzTizz\\2Nrmdb.exe\""	2Nrmdb.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\WXTVEu\\WXTVEu.exe\""	WXTVEu.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2096	cmd.exe
3804	cmd.exe
2844	cmd.exe
2904	cmd.exe
5028	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	2Nrmdb.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\WXTVEu\image.png	2Nrmdb.exe
File created	C:\Program Files (x86)\WXTVEu\thumbs.db	2Nrmdb.exe
File opened for modification	C:\Program Files (x86)\WXTVEu\WXTVEu.exe	2Nrmdb.exe
File opened for modification	C:\Program Files (x86)\6iR5R2	WXTVEu.exe
File created	C:\Program Files (x86)\6iR5R2\1NfwgliO.exe	WXTVEu.exe
File created	C:\Program Files (x86)\WXTVEu\WXTVEu.exe	2Nrmdb.exe
File created	C:\Program Files (x86)\WXTVEu\XPSPLOG.dll	2Nrmdb.exe
File opened for modification	C:\Program Files (x86)\WXTVEu\XPSPLOG.dll	2Nrmdb.exe
File opened for modification	C:\Program Files (x86)\WXTVEu\image.png	2Nrmdb.exe
File opened for modification	C:\Program Files (x86)\6iR5R2\image.png	WXTVEu.exe
File opened for modification	C:\Program Files (x86)\6iR5R2\1NfwgliO.exe	WXTVEu.exe
File opened for modification	C:\Program Files (x86)\WXTVEu	2Nrmdb.exe
File created	C:\Program Files (x86)\6iR5R2\thumbs.db	WXTVEu.exe
File opened for modification	C:\Program Files (x86)\6iR5R2\thumbs.db	WXTVEu.exe
File opened for modification	C:\Program Files (x86)\6iR5R2\XPSPLOG.dll	WXTVEu.exe
File opened for modification	C:\Program Files (x86)\WXTVEu\thumbs.db	2Nrmdb.exe
File created	C:\Program Files (x86)\6iR5R2\image.png	WXTVEu.exe
File created	C:\Program Files (x86)\6iR5R2\XPSPLOG.dll	WXTVEu.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	WXTVEu.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WXTVEu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	WXTVEu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	WXTVEu.exe

Executes a command shell one-liner 1 TTPs 23 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2088	cmd.exe
2180	cmd.exe
4236	cmd.exe
1848	cmd.exe
5492	cmd.exe
1080	cmd.exe
5820	cmd.exe
2820	cmd.exe
5692	cmd.exe
3176	cmd.exe
2284	cmd.exe
1540	cmd.exe
5868	cmd.exe
2292	cmd.exe
5100	cmd.exe
1420	cmd.exe
2376	cmd.exe
3908	cmd.exe
4352	cmd.exe
256	cmd.exe
3460	cmd.exe
4212	cmd.exe
5320	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	WXTVEu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	WXTVEu.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.02.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	2Nrmdb.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	2Nrmdb.exe

System Location Discovery: System Language Discovery 1 TTPs 41 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WXTVEu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WXTVEu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1NfwgliO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WXTVEu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1NfwgliO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	WXTVEu.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WXTVEu.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	WXTVEu.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	WXTVEu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	WXTVEu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	WXTVEu.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	WXTVEu.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1956	schtasks.exe
1984	schtasks.exe
4204	schtasks.exe
1136	schtasks.exe
4940	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
4584	install.2.0.02.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe
5500	2Nrmdb.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	996	powershell.exe
Token: SeIncreaseQuotaPrivilege	996	powershell.exe
Token: SeSecurityPrivilege	996	powershell.exe
Token: SeTakeOwnershipPrivilege	996	powershell.exe
Token: SeLoadDriverPrivilege	996	powershell.exe
Token: SeSystemProfilePrivilege	996	powershell.exe
Token: SeSystemtimePrivilege	996	powershell.exe
Token: SeProfSingleProcessPrivilege	996	powershell.exe
Token: SeIncBasePriorityPrivilege	996	powershell.exe
Token: SeCreatePagefilePrivilege	996	powershell.exe
Token: SeBackupPrivilege	996	powershell.exe
Token: SeRestorePrivilege	996	powershell.exe
Token: SeShutdownPrivilege	996	powershell.exe
Token: SeDebugPrivilege	996	powershell.exe
Token: SeSystemEnvironmentPrivilege	996	powershell.exe
Token: SeRemoteShutdownPrivilege	996	powershell.exe
Token: SeUndockPrivilege	996	powershell.exe
Token: SeManageVolumePrivilege	996	powershell.exe
Token: 33	996	powershell.exe
Token: 34	996	powershell.exe
Token: 35	996	powershell.exe
Token: 36	996	powershell.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5500 wrote to memory of 996	5500	2Nrmdb.exe	91
PID 5500 wrote to memory of 5028	5500	2Nrmdb.exe	93
PID 5028 wrote to memory of 4204	5028	cmd.exe	96
PID 5028 wrote to memory of 4692	5028	cmd.exe	98
PID 5500 wrote to memory of 2096	5500	2Nrmdb.exe	99
PID 5028 wrote to memory of 3604	5028	cmd.exe	104
PID 5500 wrote to memory of 3804	5500	2Nrmdb.exe	105
PID 2096 wrote to memory of 1136	2096	cmd.exe	106
PID 3804 wrote to memory of 4940	3804	cmd.exe	108
PID 2096 wrote to memory of 3056	2096	cmd.exe	109
PID 5500 wrote to memory of 2844	5500	2Nrmdb.exe	111
PID 3804 wrote to memory of 5816	3804	cmd.exe	113
PID 2096 wrote to memory of 2772	2096	cmd.exe	114
PID 3804 wrote to memory of 4068	3804	cmd.exe	116
PID 2844 wrote to memory of 1956	2844	cmd.exe	117
PID 2844 wrote to memory of 4320	2844	cmd.exe	118
PID 5500 wrote to memory of 2904	5500	2Nrmdb.exe	120
PID 2904 wrote to memory of 1984	2904	cmd.exe	123
PID 2844 wrote to memory of 4892	2844	cmd.exe	122
PID 2904 wrote to memory of 4112	2904	cmd.exe	124
PID 2904 wrote to memory of 2684	2904	cmd.exe	125
PID 2292 wrote to memory of 484	2292	cmd.exe	129
PID 1540 wrote to memory of 4380	1540	cmd.exe	130
PID 5868 wrote to memory of 1516	5868	cmd.exe	131
PID 5500 wrote to memory of 3832	5500	2Nrmdb.exe	132
PID 3832 wrote to memory of 4352	3832	WXTVEu.exe	136
PID 3832 wrote to memory of 5100	3832	WXTVEu.exe	137
PID 3832 wrote to memory of 256	3832	WXTVEu.exe	140
PID 3832 wrote to memory of 1080	3832	WXTVEu.exe	143
PID 3832 wrote to memory of 5320	3832	WXTVEu.exe	145
PID 3832 wrote to memory of 2088	3832	WXTVEu.exe	147
PID 5100 wrote to memory of 5872	5100	cmd.exe	149
PID 3832 wrote to memory of 5492	3832	WXTVEu.exe	150
PID 5492 wrote to memory of 4340	5492	cmd.exe	152
PID 3832 wrote to memory of 4212	3832	WXTVEu.exe	153
PID 4212 wrote to memory of 5764	4212	cmd.exe	155
PID 3832 wrote to memory of 5820	3832	WXTVEu.exe	156
PID 5820 wrote to memory of 4164	5820	cmd.exe	158
PID 3832 wrote to memory of 3908	3832	WXTVEu.exe	159
PID 3908 wrote to memory of 2712	3908	cmd.exe	161
PID 3832 wrote to memory of 2284	3832	WXTVEu.exe	162
PID 2284 wrote to memory of 4940	2284	cmd.exe	164
PID 3832 wrote to memory of 2180	3832	WXTVEu.exe	165
PID 2180 wrote to memory of 3652	2180	cmd.exe	167
PID 3832 wrote to memory of 2820	3832	WXTVEu.exe	168
PID 2820 wrote to memory of 1960	2820	cmd.exe	170
PID 3832 wrote to memory of 2376	3832	WXTVEu.exe	171
PID 2376 wrote to memory of 3668	2376	cmd.exe	173
PID 3832 wrote to memory of 1848	3832	WXTVEu.exe	174
PID 1848 wrote to memory of 1416	1848	cmd.exe	176
PID 3832 wrote to memory of 3176	3832	WXTVEu.exe	177
PID 3176 wrote to memory of 1356	3176	cmd.exe	179
PID 3832 wrote to memory of 4236	3832	WXTVEu.exe	180
PID 4236 wrote to memory of 2460	4236	cmd.exe	182
PID 3832 wrote to memory of 1420	3832	WXTVEu.exe	183
PID 1420 wrote to memory of 2424	1420	cmd.exe	185
PID 3832 wrote to memory of 3460	3832	WXTVEu.exe	186
PID 3460 wrote to memory of 4400	3460	cmd.exe	188
PID 3832 wrote to memory of 5692	3832	WXTVEu.exe	189
PID 5692 wrote to memory of 1372	5692	cmd.exe	191

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	WXTVEu.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.02.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4584

C:\Users\Public\rzTizz\2Nrmdb.exe
"C:\Users\Public\rzTizz\2Nrmdb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5500
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:996
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\rzTizz\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5028
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\rzTizz\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4204
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2096
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1136
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2772
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3804
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4940
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5816
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4068
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2844
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1956
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4320
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2904
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1984
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2684
- C:\Program Files (x86)\WXTVEu\WXTVEu.exe
  "C:\Program Files (x86)\WXTVEu\WXTVEu.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Checks BIOS information in registry
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3832
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4352
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5100
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5872
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:256
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1080
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2088
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5492
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4340
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4212
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5764
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\WXTVEu.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5820
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\WXTVEu.exe" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4164
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\WXTVEu.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3908
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\WXTVEu.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2712
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\WXTVEu.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2284
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\WXTVEu.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4940
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2180
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\image.png" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3652
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2820
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1960
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2376
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3668
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1848
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\thumbs.db" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1416
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3176
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1356
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4236
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2460
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1420
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\XPSPLOG.dll" /inheritance:r
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3460
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4400
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\WXTVEu\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5692
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\WXTVEu\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1372

C:\Users\Public\rzTizz\2Nrmdb.exe
"C:\Users\Public\rzTizz\2Nrmdb.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2712

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\rzTizz" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\rzTizz" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4380

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:4260

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1516

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2292
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:484

C:\Program Files (x86)\WXTVEu\WXTVEu.exe
"C:\Program Files (x86)\WXTVEu\WXTVEu.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:3268

C:\Program Files (x86)\WXTVEu\WXTVEu.exe
"C:\Program Files (x86)\WXTVEu\WXTVEu.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:5164

C:\Program Files (x86)\6iR5R2\1NfwgliO.exe
"C:\Program Files (x86)\6iR5R2\1NfwgliO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:780

C:\Program Files (x86)\WXTVEu\WXTVEu.exe
"C:\Program Files (x86)\WXTVEu\WXTVEu.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:4064

C:\Program Files (x86)\6iR5R2\1NfwgliO.exe
"C:\Program Files (x86)\6iR5R2\1NfwgliO.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:6124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\6iR5R2\XPSPLOG.dll
Size 4.6MB
SHA256 b60dddada6b56250af6abe1177347c2f4e4ea11bc798fb2766c87df593ce8dbe
MD5 b34107deec9c31bac2a00d8ff6ef2d90
SHA1 ef00f8e3115f99c1fab9a172b760437ac9472455
SHA512 e11ea8a98a0a94588335f89a953e379f7134e2ac8b75dfaba93cd012c86fb84203057469f3218aaf7c86d42aa631937f3d4781022e4a227bff67842e226da91e
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy6:BMWKfU+BcUTHCCCfqCiUffn6
TLSH
T123263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\6iR5R2\image.png
Size 4.8MB
SHA256 8a7f1113c9840601fb307e198dac508eb47007459d6a15a1259c97f903801a70
MD5 87b1bf321f1f9b09c53f18c31121cbd6
SHA1 f2874aa379fa5c155220628edbd8a4d1d8ddccaf
SHA512 4d844973f87040afc02e7f7de9739289a64ce3dc96051c8aef1a1105f4f573b95be2a3d3de0ece4641f17d23ec11722551f913a6e090c59de7c766e7be806759
SSDEEP 98304:f/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:fMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T17A36334FE6EFBED9C398F7EA71098A30D63A4FBE1542392560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

WXTVEu.exe

Path C:\Program Files (x86)\WXTVEu\WXTVEu.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\WXTVEu\XPSPLOG.dll
Size 4.6MB
SHA256 9ca70bf15da6e2c4b7d4515a8b86188a012a9b0888ebad6a51f3ef66d46aba62
MD5 b9b470f499af1bccfbfec312dbc6ab44
SHA1 3773f3e631287be894037ebc87723faa4467c8ee
SHA512 83560aedf0957237323b002326fadc135b8bd5c38a5941a0b79b4c86233c9de176cd086e2869a500d57b32a3503732e7a2074e9b08a6952d74998129835f8839
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyh:BMWKfU+BcUTHCCCfqCiUffnh
TLSH
T1F9263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\WXTVEu\image.png
Size 4.8MB
SHA256 794a5efdc6d89a75da25512c1bdf223ab177292ffaa98c276b4d77402c7bddd6
MD5 862c318acfe1a8dd4447e3741e9ab06f
SHA1 63c037ba2d6af0b2c7a9ed2a68cc9a0fa9f9115f
SHA512 c2e62afff27f76df3d06617d6307c9a0e0acaa9b5de241ee8d6ebb8e873a9eb70e37fc0eab7196d2693171aef0f656c77d3d0d33e30ed512e4908f052c5f2a61
SSDEEP 98304:7/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:7MpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T14836334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\WXTVEu\thumbs.db
Size 358KB
SHA256 08a73eb15ffc31d1eae4ba79bef63e4c2b66ffb3aea191d372b338f46cd1113c
MD5 8182f103f1687329f9abebb5c8a561f6
SHA1 13f80e9899ffe1a8d0f39bee2362b6665a24c307
SHA512 6949d2d74adaf90c9789fa4acaa997cda0c98dceea95bdeb76bac48f4e1e0904d8bb822d96fc0ad14a9078c4560d99e92359cbd4f4b938058c7de185e86d0270
SSDEEP 6144:ziACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:G8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T12A74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 c7cabf8a593fd2e39ddd70f5efc9b900b6d18725b3ec1aaa99f6659e3d25a004
MD5 6398e883089b5ff7d598fa2e2f4385c1
SHA1 a4f9097703aefad709f3dbda1a40b833afd5dbda
SHA512 116e6e903d1604146cee65d288bad830716bf705f1d7dd0eaf172b28bbe20fc7fd5c16a8486d2ff02fe86a21c61c43b39ee8fdae42893021a1a24032ca675ce4
TLSH
T17C3196BB3FBD3C828F294D5425C9A6222CF5E1406CC6589E6255C498DF053B22F4F50D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 9c95859992125703b840ead5dcae4d6db746509ef3d9289dda663e60b5bbc8a4
MD5 09590ce0ccef7bc23e46820269889a60
SHA1 dd5a97ee51f8c4911c8f390dd865834ad1fc25ad
SHA512 08aba2e923a96574be46dcf3c561309784533f1a34242179db2ed869a1c29c5282def78d36881f420b80e1fc67403e17a0a93bcbed606f8b467899dbcc037a58
TLSH
T10631F682DE3804519F0C0F3852C4D23FBCF4912858E44846723EC26B4D05F7B6FC6004
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 71c728a8f9f04d9867a0ebfb053a6ec5a9bbaad248cbf14a0ba338e57a465d52
MD5 2ee4c70e0294f01d37705e1003359c16
SHA1 f94846bc79a912f12084b0bc46f0f162ad2fc011
SHA512 832f0c7a39111a2eafe6080d6c23a1503c0b3c4ab3780d90972b73df13129429a1cd6260f8fcb43e0f565195620382437620fd4db0204bb6455d12c4254daf18
TLSH
T101F05C1448BC613DF133DA398BC979D6066EEA02340145A40AA04709AA15B452DA19B6
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 4028dcb8405335ddbfa7cefe58ad927c32428d52333ea88d4f4889415f9509e3
MD5 ee4c397eafac1336a4216cc6de788979
SHA1 8c2839c157161aed08d977bd2c7296deea347628
SHA512 a5e8cfc5e215ab4414809f55584d248fddb539b932e90d088ac180aa1f1b7cd27797e4218c72b96561262fa37dab2a3a5c6d8e1e5a4f7cfbaecd6af31ee676d2
TLSH
T18BF05C2557DE002BF03BE6B88AD67EB29A29F2330046656E0AE652452F51F435C5226D
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_dgzkjvvc.0pc.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dgzkjvvc.0pc.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

2Nrmdb.exe

Path C:\Users\Public\rzTizz\2Nrmdb.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\rzTizz\UxEnhance64.dll
Size 3.1MB
SHA256 5205c8b507536b340bbad02ddd115b3a8dac7d08636470c273f94c08f8bb7934
MD5 285ebab3c70c318952cd7b1a53afdedb
SHA1 cde932311ad663c3f2fbd5d76b6726146537ca27
SHA512 be183566eaac8ab1c2c17041f9ad1d7403af778f1a21671e6e773f99ba5242e6dec2a75d21c5ce876c53e346c7c7632dc559cbb7f5338f8291b8f1a4d2654337
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+4:P9m29xx3Tiqt06ox6+z2rNNrKo4
TLSH
T1E2E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\rzTizz\adoresd.dat
Size 4.8MB
SHA256 68ac4d4b4d0e90d423fec311af1d9c2a8a8cf38785a33fc16610fa8e11f9daeb
MD5 86bc3ebdf4e73fc2df3da2c0604df39e
SHA1 ec1235adec6d928bbd9e08b5255cb4035211ba5e
SHA512 0bdf8911e809ab41994e0c1a436b446042c28db1b8627e1124ffc39c71bad926434c33adc51527834e280481fdfafe2b52f8fd937c7d25dc6f8c0a45c3973e55
SSDEEP 98304:SWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:SWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1873633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\rzTizz\msadox.tb
Size 8KB
SHA256 a31f72529e2fac53e24644b20ede4206997af4d9ebf95c768b0fa3caef9b7241
MD5 ed12e0caad42b78ea5ef4437937d9da1
SHA1 9782a813d220e06a741d4d172bd011ad7b303f94
SHA512 70e445fa39f8c498c2b336f80145871d726d5b25c2697895c1ee9adf7bc404fdde22dd76a81e9c95c7023a4973d9c5c801939481d2a4a143fc4910d5d9c7c0b4
SSDEEP 192:1qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:1sZqZOXQ3uqvR2Kfzp
TLSH
T1B0029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/780-771-0x0000000002E10000-0x00000000035ED000-memory.dmp

Download

memory/780-774-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/780-768-0x0000000002E10000-0x00000000035ED000-memory.dmp

Download

memory/780-763-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

Download

memory/780-764-0x00000000733A0000-0x0000000073AEA000-memory.dmp

Download

memory/780-770-0x0000000000AE0000-0x0000000000AE1000-memory.dmp

Download

memory/996-606-0x0000011EEF5B0000-0x0000011EEF5BA000-memory.dmp

Download

memory/996-604-0x0000011EEF800000-0x0000011EEF81E000-memory.dmp

Download

memory/996-600-0x0000011EEF5D0000-0x0000011EEF5F2000-memory.dmp

Download

memory/996-605-0x0000011EEF820000-0x0000011EEF8D2000-memory.dmp

Download

memory/2712-587-0x0000024F61910000-0x0000024F621E7000-memory.dmp

Download

memory/2712-589-0x0000024F61910000-0x0000024F621E7000-memory.dmp

Download

memory/2712-591-0x00007FFC2DCB0000-0x00007FFC2DCB2000-memory.dmp

Download

memory/2712-582-0x00007FFC2DCC0000-0x00007FFC2DCC2000-memory.dmp

Download

memory/2712-590-0x0000024F61910000-0x0000024F621E7000-memory.dmp

Download

memory/2712-588-0x0000024F61910000-0x0000024F621E7000-memory.dmp

Download

memory/2712-576-0x00007FFC0B060000-0x00007FFC0B57E000-memory.dmp

Download

memory/2712-580-0x0000024F61910000-0x0000024F621E7000-memory.dmp

Download

memory/2712-583-0x0000024F61910000-0x0000024F621E7000-memory.dmp

Download

memory/3268-722-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/3268-739-0x00000000026D0000-0x00000000026D1000-memory.dmp

Download

memory/3268-740-0x0000000003310000-0x0000000003AED000-memory.dmp

Download

memory/3268-731-0x0000000003310000-0x0000000003AED000-memory.dmp

Download

memory/3268-723-0x00000000747F0000-0x0000000074F3A000-memory.dmp

Download

memory/3268-748-0x0000000000DC0000-0x0000000000DC1000-memory.dmp

Download

memory/3832-776-0x0000000006330000-0x000000000636D000-memory.dmp

Download

memory/3832-712-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3832-754-0x0000000003AA0000-0x000000000427D000-memory.dmp

Download

memory/3832-682-0x0000000003AA0000-0x000000000427D000-memory.dmp

Download

memory/3832-762-0x0000000003AA0000-0x000000000427D000-memory.dmp

Download

memory/3832-707-0x0000000003AA0000-0x000000000427D000-memory.dmp

Download

memory/3832-693-0x0000000003080000-0x0000000003094000-memory.dmp

Download

memory/3832-674-0x0000000001200000-0x0000000001201000-memory.dmp

Download

memory/3832-675-0x00000000747F0000-0x0000000074F3A000-memory.dmp

Download

memory/3832-686-0x0000000003AA0000-0x000000000427D000-memory.dmp

Download

memory/3832-679-0x0000000003AA0000-0x000000000427D000-memory.dmp

Download

memory/3832-681-0x0000000001640000-0x0000000001641000-memory.dmp

Download

memory/4064-785-0x00000000747F0000-0x0000000074F3A000-memory.dmp

Download

memory/4064-792-0x0000000002EA0000-0x000000000367D000-memory.dmp

Download

memory/4064-784-0x0000000000630000-0x0000000000631000-memory.dmp

Download

memory/4584-504-0x00007FFC21EA0000-0x00007FFC21EB2000-memory.dmp

Download

memory/4584-525-0x00007FFC21EA0000-0x00007FFC21EB2000-memory.dmp

Download

memory/4584-524-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/4584-2-0x00000000004D0000-0x00000000004DC000-memory.dmp

Download

memory/4584-1-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/4584-0-0x0000000000480000-0x000000000048E000-memory.dmp

Download

memory/5164-735-0x0000000003980000-0x000000000415D000-memory.dmp

Download

memory/5164-744-0x0000000001280000-0x0000000001281000-memory.dmp

Download

memory/5164-727-0x00000000747F0000-0x0000000074F3A000-memory.dmp

Download

memory/5164-745-0x0000000003980000-0x000000000415D000-memory.dmp

Download

memory/5164-726-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/5164-752-0x0000000001260000-0x0000000001261000-memory.dmp

Download

memory/5500-558-0x000001F55FC00000-0x000001F55FC4E000-memory.dmp

Download

memory/5500-539-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-564-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-566-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-561-0x000001F560FF0000-0x000001F56107A000-memory.dmp

Download

memory/5500-562-0x000001F560FF0000-0x000001F56107A000-memory.dmp

Download

memory/5500-556-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-567-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-559-0x000001F560FF0000-0x000001F56107A000-memory.dmp

Download

memory/5500-550-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-546-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-560-0x000001F560FF0000-0x000001F56107A000-memory.dmp

Download

memory/5500-545-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-544-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-543-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-538-0x00007FFC2DCC0000-0x00007FFC2DCC2000-memory.dmp

Download

memory/5500-536-0x000001F560710000-0x000001F560FE7000-memory.dmp

Download

memory/5500-531-0x00007FFC0B060000-0x00007FFC0B57E000-memory.dmp

Download

memory/5500-530-0x00007FFC2DCB0000-0x00007FFC2DCB2000-memory.dmp

Download

memory/6124-789-0x00000000733A0000-0x0000000073AEA000-memory.dmp

Download

memory/6124-788-0x0000000002890000-0x0000000002891000-memory.dmp

Download